v1.2.4

Author: CoderLuii

Dockerfile

@@ -63,7 +63,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # ---------- bubblewrap setuid (Codex CLI sandbox on restricted kernels) ----------
-RUN chmod u+s /usr/bin/bwrap
+RUN test -x /usr/bin/bwrap && chown root:root /usr/bin/bwrap && chmod 4755 /usr/bin/bwrap && test "$(stat -c '%a %u %g' /usr/bin/bwrap)" = "4755 0 0"
 
 # ---------- Full-only system packages ----------
 RUN if [ "$VARIANT" = "full" ]; then \

docs/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to HolyClaude will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.2.4] - 05/27/2026
+
+### Fixed
+- Repaired bubblewrap setuid permissions at container startup so Codex `apply_patch` keeps working on Synology and other restricted-user-namespace hosts after `docker compose pull && docker compose up -d`.
+
 ## [1.2.3] - 05/27/2026
 
 ### Changed

scripts/entrypoint.sh

@@ -44,6 +44,25 @@ if ! runuser -u "$CLAUDE_USER" -- test -w "$WORKSPACE_DIR"; then
     echo "[entrypoint] WARNING: /workspace is still not writable; fix host ownership or PUID/PGID"
 fi
 
+# ---------- Repair bubblewrap setuid permissions ----------
+BWRAP_BIN="/usr/bin/bwrap"
+if [ -x "$BWRAP_BIN" ]; then
+    bwrap_mode="$(stat -c "%a %u %g" "$BWRAP_BIN" 2>/dev/null || true)"
+    if [ "$bwrap_mode" != "4755 0 0" ]; then
+        echo "[entrypoint] Repairing bubblewrap setuid permissions"
+        chown root:root "$BWRAP_BIN" 2>/dev/null || true
+        chmod 4755 "$BWRAP_BIN" 2>/dev/null || true
+        bwrap_mode="$(stat -c "%a %u %g" "$BWRAP_BIN" 2>/dev/null || true)"
+    fi
+
+    if [ "$bwrap_mode" != "4755 0 0" ]; then
+        final_mode="${bwrap_mode:-missing}"
+        echo "[entrypoint] WARNING: /usr/bin/bwrap mode is ${final_mode:-missing}, expected 4755 0 0; Codex sandbox may fail on restricted kernels"
+    fi
+else
+    echo "[entrypoint] WARNING: /usr/bin/bwrap is missing or not executable; Codex sandbox may fail"
+fi
+
 # ---------- Codex CLI config symlink (every boot) ----------
 mkdir -p "$CLAUDE_HOME/.claude/.codex"
 chown "$PUID:$PGID" "$CLAUDE_HOME/.claude/.codex"