first commit

entrypoint.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+set -euo pipefail
+
+CERT_DIR="${CERT_DIR:-/host-certs}"
+
+if [[ -d "$CERT_DIR" ]]; then
+  shopt -s nullglob
+  certs=("$CERT_DIR"/*.crt "$CERT_DIR"/*.pem)
+  if ((${#certs[@]})); then
+    mkdir -p /usr/local/share/ca-certificates/opencode-host
+    for cert in "${certs[@]}"; do
+      target="/usr/local/share/ca-certificates/opencode-host/$(basename "${cert%.*}").crt"
+      if openssl x509 -in "$cert" -noout >/dev/null 2>&1; then
+        cp -f "$cert" "$target"
+      else
+        echo "WARNING: ignoring invalid CA certificate: $cert" >&2
+      fi
+    done
+    if update-ca-certificates >/tmp/opencode-ca.log 2>&1; then
+      :
+    else
+      echo "WARNING: update-ca-certificates failed; continuing." >&2
+      cat /tmp/opencode-ca.log >&2 || true
+    fi
+  fi
+fi
+
+host_lang="${HOST_LANG:-${LANG:-C.UTF-8}}"
+host_lc_all="${HOST_LC_ALL:-${LC_ALL:-}}"
+
+# Generate a host locale when it is a valid UTF-8 locale and not already present.
+if [[ "$host_lang" == *.UTF-8 && "$host_lang" != "C.UTF-8" ]]; then
+  if ! locale -a | grep -Fxqi "${host_lang//UTF-8/utf8}"; then
+    if [[ "$host_lang" =~ ^([A-Za-z_]+)\.UTF-8$ ]]; then
+      locale_name="${BASH_REMATCH[1]}.UTF-8"
+      if grep -qE "^#?[[:space:]]*${locale_name}[[:space:]]+UTF-8" /etc/locale.gen 2>/dev/null; then
+        sed -i -E "s/^#[[:space:]]*(${locale_name}[[:space:]]+UTF-8)/\1/" /etc/locale.gen
+      else
+        printf '%s UTF-8\n' "$locale_name" >> /etc/locale.gen
+      fi
+      locale-gen "$locale_name" >/dev/null 2>&1 || \
+        echo "WARNING: could not generate locale $host_lang; continuing." >&2
+    fi
+  fi
+fi
+
+export LANG="$host_lang"
+if [[ -n "$host_lc_all" ]]; then
+  export LC_ALL="$host_lc_all"
+fi
+
+# The image entrypoint is root only for one-time runtime setup; the shell/OpenCode
+# process itself always runs as the unprivileged dev user.
+exec su -s /bin/bash dev -c 'cd "${START_DIR:-/workspace}" && exec "$@"' -- "$@"