fix: make FakeMySQL capture dir writable under Docker bind mounts

Entrypoint chowns chains-config cache (and related runtime dirs) for
appuser before dropping privileges, so LOCAL INFILE captures no longer
fail with AccessDeniedException on root-owned empty volume mounts.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Ar3h

Dockerfile

@@ -1,14 +1,25 @@
 FROM eclipse-temurin:8u432-b06-jdk-jammy
 
-RUN addgroup --system appgroup && adduser --system appuser --ingroup appgroup
+RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
 
 WORKDIR /chains
 
 COPY --chown=appuser:appgroup java-chains.jar /chains/java-chains.jar
 COPY --chown=appuser:appgroup chains-config/ /chains/chains-config/
 
-USER appuser
+# Runtime-writable paths used by FakeMySQL captures / plugins / presets.
+# Bind mounts may overlay chains-config; entrypoint then fixes ownership.
+RUN mkdir -p /chains/chains-config/cache/fake-server-files \
+        /chains/chains-config/plugins \
+        /chains/chains-config/presets \
+        /chains/chains-config/plugin-data \
+    && chown -R appuser:appgroup /chains
+
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh
 
 EXPOSE 8011 58080 50389 50388 13999 3308 11527 50000
 
+# Entrypoint starts as root to repair bind-mount permissions, then drops to appuser.
+ENTRYPOINT ["docker-entrypoint.sh"]
 CMD ["java", "-jar", "-Xms512m", "-Xmx2g", "-XX:+UseG1GC", "/chains/java-chains.jar"]

README.md

@@ -27,14 +27,17 @@ Docs: https://java-chains.github.io/en/docs/guide
 ### Docker Compose
 
 ```bash
-# optional: place chains-config from the release tarball next to docker-compose.yml
+# recommended: place chains-config from the release tarball next to docker-compose.yml
+# (an empty ./chains-config mount still starts, but hides image-baked config/plugins)
 docker compose up -d
 # startup banner prints credentials on the "Auth" line
 docker logs -f java-chains | grep -i auth
 ```
 
 Open `http://your-ip:8011`
 
+**FakeMySQL read files:** `FakeMySQLReadPayload` asks the **victim JDBC client** to send a path (e.g. `/etc/passwd` on the victim). Chains does **not** open that path inside the container. Captured bytes are written under `chains-config/cache/fake-server-files/` (browse in Studio → FakeMySQL Files). The image entrypoint ensures that cache dir is writable by the non-root `appuser` even when the bind mount was created as root.
+
 ### Docker run
 
 ```bash

README.zh-cn.md

@@ -27,14 +27,17 @@
 ### Docker Compose
 
 ```bash
-# 可选：把 release 包里的 chains-config 放到本目录旁（与 docker-compose.yml 同级）
+# 推荐：把 release 包里的 chains-config 放到本目录旁（与 docker-compose.yml 同级）
+# （空的 ./chains-config 挂载仍可启动，但会遮住镜像内置的配置/插件）
 docker compose up -d
 # 启动横幅里账号密码在 "Auth" 行
 docker logs -f java-chains | grep -i auth
 ```
 
 打开 `http://your-ip:8011`
 
+**FakeMySQL 读文件：** `FakeMySQLReadPayload` 让**受害端 JDBC 客户端**去读你配置的路径（例如受害者机器上的 `/etc/passwd`），**不是**在容器内打开该路径。读回内容落在 `chains-config/cache/fake-server-files/`（Studio → FakeMySQL 文件）。镜像 entrypoint 会保证非 root 的 `appuser` 即使在 root 创建的 bind mount 下也能写入该缓存目录。
+
 ### Docker run
 
 ```bash

docker-compose.yml

@@ -21,8 +21,19 @@ services:
       # 可选：启动时查询公网 IP（会访问第三方 IP 回显服务）
       CHAINS_SHOW_PUBLIC_IP: ${CHAINS_SHOW_PUBLIC_IP:-false}
     volumes:
-      # 持久化配置 / 插件 / third-libs / presets
+      # Persist config / plugins / presets / FakeMySQL captures.
+      # Prefer copying chains-config from the release tarball next to this file.
+      # An empty host dir still works for writes (entrypoint chowns it for appuser),
+      # but hides the image's baked-in chains-config — copy from the tarball for plugins.
       - ./chains-config:/chains/chains-config
+      # Optional: mount a host path you want available *inside* the container for
+      # other tooling. FakeMySQLReadPayload does NOT read host/container files itself —
+      # the victim JDBC client reads the path you configure (e.g. /etc/passwd on the victim).
+      # Captures land in chains-config/cache/fake-server-files/.
+      # - /path/on/host:/chains/host-files:ro
+    # Optional: run as a specific host UID/GID instead of image appuser.
+    # Entrypoint skips chown when not root; ensure the volume is writable by that user.
+    # user: "1000:1000"
     networks:
       - java-chains-net
 

docker-entrypoint.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Ensure bind-mounted chains-config is writable by appuser, then drop privileges.
+# FakeMySQL LOCAL INFILE captures are persisted under:
+#   chains-config/cache/fake-server-files/
+# Empty host mounts (./chains-config created as root:root) otherwise yield
+# AccessDeniedException and appear as "cannot read files" in the UI.
+set -eu
+
+APP_USER="${CHAINS_APP_USER:-appuser}"
+APP_GROUP="${CHAINS_APP_GROUP:-appgroup}"
+CONFIG_DIR="${CHAINS_CONFIG_DIR:-/chains/chains-config}"
+
+ensure_dir_writable_by_app() {
+  dir="$1"
+  mkdir -p "$dir"
+  if ! runuser -u "$APP_USER" -- test -w "$dir" 2>/dev/null; then
+    chown "$APP_USER:$APP_GROUP" "$dir" || true
+  fi
+}
+
+if [ "$(id -u)" = "0" ]; then
+  mkdir -p "$CONFIG_DIR"
+  # Host bind mounts often create the volume root as root:root (mode 755).
+  # Chown the directory inode (not a recursive tree walk) so appuser can create
+  # cache/plugin/preset children without rewriting user plugin contents.
+  if ! runuser -u "$APP_USER" -- test -w "$CONFIG_DIR" 2>/dev/null; then
+    chown "$APP_USER:$APP_GROUP" "$CONFIG_DIR" || true
+  fi
+
+  ensure_dir_writable_by_app "$CONFIG_DIR/cache"
+  ensure_dir_writable_by_app "$CONFIG_DIR/cache/fake-server-files"
+  ensure_dir_writable_by_app "$CONFIG_DIR/plugins"
+  ensure_dir_writable_by_app "$CONFIG_DIR/presets"
+  ensure_dir_writable_by_app "$CONFIG_DIR/plugin-data"
+
+  # Previous root-owned captures under cache/ would still be unreadable; reclaim cache only.
+  if [ -d "$CONFIG_DIR/cache" ]; then
+    chown -R "$APP_USER:$APP_GROUP" "$CONFIG_DIR/cache" 2>/dev/null || true
+  fi
+
+  if command -v setpriv >/dev/null 2>&1; then
+    exec setpriv --reuid="$APP_USER" --regid="$APP_GROUP" --init-groups -- "$@"
+  fi
+  exec runuser -u "$APP_USER" -- "$@"
+fi
+
+exec "$@"