From 898441af0cab606df87a8363f3ad6ff878909114 Mon Sep 17 00:00:00 2001 From: Steve Dogiakos Date: Sat, 28 Mar 2026 23:23:14 -0600 Subject: [PATCH] fix: add set -e and gunicorn worker timeout to entrypoint set -e ensures the script aborts on any error (e.g. failed chown) rather than silently continuing. --timeout 30 kills hung workers to prevent slow-client attacks from exhausting the worker pool. --- entrypoint.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/entrypoint.sh b/entrypoint.sh index 288fb4c..3f82cc6 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,4 +1,6 @@ #!/bin/sh +set -e + # Fix ownership of the data directory so appuser can write the database. # This runs as root (no USER directive in Dockerfile) and is safe because # we immediately drop privileges via gosu before starting the app. @@ -9,4 +11,8 @@ chown -R appuser:appuser "$DATA_DIR" envsubst < /app/templates/index.html.template > /app/templates/index.html # Drop to appuser and start Gunicorn -exec gosu appuser gunicorn --bind 0.0.0.0:8000 app:app --workers ${GUNICORN_WORKERS:-3} +exec gosu appuser gunicorn \ + --bind 0.0.0.0:8000 \ + --workers ${GUNICORN_WORKERS:-3} \ + --timeout 30 \ + app:app