| set -eu | |
| home_dir="${HOME:-/data}" | |
| xdg_config_home="${XDG_CONFIG_HOME:-$home_dir/.config}" | |
| default_config_path="$xdg_config_home/pinchtab/config.json" | |
| mkdir -p "$home_dir" "$xdg_config_home" "$(dirname "$default_config_path")" | |
| # Generate a persisted config on first boot. | |
| # The PINCHTAB_TOKEN env var can be used to set an auth token via Docker secrets | |
| # or environment variables. Prefer Docker secrets for sensitive data: | |
| # docker run -e PINCHTAB_TOKEN_FILE=/run/secrets/pinchtab_token | |
| if [ -z "${PINCHTAB_CONFIG:-}" ] && [ ! -f "$default_config_path" ]; then | |
| /usr/local/bin/pinchtab config init >/dev/null | |
| # Docker containers need to bind to 0.0.0.0 for port publishing to work | |
| /usr/local/bin/pinchtab config set server.bind "0.0.0.0" >/dev/null | |
| /usr/local/bin/pinchtab config set server.port "7860" >/dev/null | |
| if [ -n "${PINCHTAB_TOKEN:-}" ]; then | |
| /usr/local/bin/pinchtab config set server.token "$PINCHTAB_TOKEN" >/dev/null | |
| elif [ -n "${BEARER_TOKEN:-}" ]; then | |
| /usr/local/bin/pinchtab config set server.token "$BEARER_TOKEN" >/dev/null | |
| fi | |
| fi | |
| # CHROME SANDBOX DISABLED IN CONTAINERS | |
| # | |
| # Chrome requires --no-sandbox inside containers because: | |
| # - Containers don't have user namespaces (sandboxing requires this) | |
| # - Container security (cgroups, capabilities, seccomp) provides isolation | |
| # - The Dockerfile already drops capabilities and uses read-only filesystem | |
| # | |
| # This is standard for headless Chrome in containerized environments. | |
| # Backfill the flag into managed config if not already set. | |
| if [ -z "${PINCHTAB_CONFIG:-}" ] && [ -f "$default_config_path" ]; then | |
| current_flags="$(/usr/local/bin/pinchtab config get browser.extraFlags 2>/dev/null || true)" | |
| if [ -z "$current_flags" ]; then | |
| /usr/local/bin/pinchtab config set browser.extraFlags -- "--no-sandbox --disable-gpu" >/dev/null | |
| fi | |
| fi | |
| exec "$@" | |