#!/bin/sh
set -e

# The admin dashboard's "Docker Logs" page needs the app process (which drops
# to the unprivileged "nextjs" user below) to read /var/run/docker.sock. Group
# membership isn't a reliable way to grant that: on Docker Desktop the
# socket's group id was observed to change across restarts (0 one time, 1001
# the next) on the same host. Chmod'ing it wide open here — while this
# container still starts as root, before the privilege drop — sidesteps that
# entirely. No-op if the socket isn't mounted (e.g. bare `npm run dev`).
if [ -S /var/run/docker.sock ]; then
  chmod 666 /var/run/docker.sock || true
fi

exec su-exec nextjs "$@"