From d4bc9173279104535c1999f12643f3102e05503d Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Thu, 13 Aug 2026 18:07:12 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20build.sh=20=E4=B8=80=E9=94=AE=E5=AE=89?=
 =?UTF-8?q?=E8=A3=85=20bwrap=EF=BC=88=E9=9B=B6root=20apt=20download+dpkg?=
 =?UTF-8?q?=20-x=EF=BC=89=EF=BC=8Cstart.sh=20=E5=8A=A0=20bin=20=E5=88=B0?=
 =?UTF-8?q?=20PATH?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 build.sh | 18 +++++++++++++++++-
 start.sh |  1 +
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/build.sh b/build.sh
index 976788a..f4d80d5 100644
--- a/build.sh
+++ b/build.sh
@@ -106,7 +106,23 @@ print('  config: password_key synced')
 fi
 
 # 10. Create runtime dirs
-mkdir -p "$cdir/logs" "$cdir/files" "$cdir/conf"
+mkdir -p "$cdir/logs" "$cdir/files" "$cdir/conf" "$cdir/bin"
+
+# 10.5 Install bwrap (zero-root: 系统已有则复用，否则 apt download + dpkg -x)
+if [ ! -x "$cdir/bin/bwrap" ]; then
+    if command -v bwrap >/dev/null 2>&1; then
+        cp "$(command -v bwrap)" "$cdir/bin/bwrap" 2>/dev/null || true
+    else
+        tmpd=$(mktemp -d)
+        ( cd "$tmpd" && apt download bubblewrap >/dev/null 2>&1 && dpkg -x bubblewrap*.deb . && cp usr/bin/bwrap "$cdir/bin/bwrap" ) 2>/dev/null || true
+        rm -rf "$tmpd"
+    fi
+fi
+if [ -x "$cdir/bin/bwrap" ]; then
+    echo "  bwrap: $("$cdir/bin/bwrap" --version 2>/dev/null | head -1)"
+else
+    echo "  WARN: bwrap not available (deploy sandbox will degrade to dir isolation)"
+fi
 # 6. Fix auto-assign created_by in CRUD dspys (xls2ui overwritten)
 for d in sd_projects sd_iterations; do
     for t in add update; do
diff --git a/start.sh b/start.sh
index 3d5b116..4eda0f2 100755
--- a/start.sh
+++ b/start.sh
@@ -13,6 +13,7 @@ if [ -f pipeline.pid ]; then
 fi
 
 echo "Starting pipeline-app on port 9090..."
+export PATH="$WORKDIR/bin:$PATH"
 $WORKDIR/py3/bin/python $WORKDIR/app/pipeline_app.py -p 9090 -w $WORKDIR >> $WORKDIR/logs/pipeline.log 2>&1 &
 echo $! > pipeline.pid
 echo "Started PID $(cat pipeline.pid)"