From c90678f2fdd8c38d3d1b24e0ceeb90ec16770686 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=AD=A3=E9=92=A7?= <huangzhengyang2020@foxmail.com>
Date: Tue, 4 Aug 2026 16:25:53 +0800
Subject: [PATCH] fix(rocklet): skip kata dind setup when docker data-root
 cannot be created

Non-root sandbox image users cannot create /var/lib/docker. With
set -o errexit, the startup script exits before rocklet starts.

Check the nearest existing parent of docker data-root and skip kata
DinD setup with a warning when directory creation is not permitted.
This preserves multi-level custom data-root paths rooted in writable
directories.
---
 rock/rocklet/local_files/docker_run.sh | 30 +++++++++++++++++++-------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/rock/rocklet/local_files/docker_run.sh b/rock/rocklet/local_files/docker_run.sh
index 2eddc4e73a..cc7e1a1977 100755
--- a/rock/rocklet/local_files/docker_run.sh
+++ b/rock/rocklet/local_files/docker_run.sh
@@ -38,13 +38,27 @@ setup_kata_dind() {
             docker_root="$custom_root"
         fi
     fi
-    mkdir -p "$docker_root"
-    for i in $(seq 0 7); do
-        mknod -m 660 /dev/loop$i b 7 $i 2>/dev/null || true
-    done
-    mount -o loop /docker-disk.img "$docker_root"
-    mount -o remount,rw /sys/fs/cgroup
-    mount -o remount,rw /proc/sys
+    # Directory creation requires write and execute permissions on the nearest existing parent.
+    if [ ! -d "$docker_root" ]; then
+        local nearest_existing_path="$docker_root"
+        while [ ! -e "$nearest_existing_path" ]; do
+            nearest_existing_path=$(dirname "$nearest_existing_path")
+        done
+        if [ ! -d "$nearest_existing_path" ] || [ ! -w "$nearest_existing_path" ] || [ ! -x "$nearest_existing_path" ]; then
+            echo "Warning: no permission to create Docker data root '$docker_root'; skipping Kata DinD setup." >&2
+        else
+            mkdir -p "$docker_root"
+        fi
+    fi
+
+    if [ -d "$docker_root" ]; then
+        for i in $(seq 0 7); do
+            mknod -m 660 /dev/loop$i b 7 $i 2>/dev/null || true
+        done
+        mount -o loop /docker-disk.img "$docker_root"
+        mount -o remount,rw /sys/fs/cgroup
+        mount -o remount,rw /proc/sys
+    fi
 }
 
 # Run rocklet
@@ -88,4 +102,4 @@ else
     # glibc-based distributions
     mkdir -p "${LOG_DIR}"
     /tmp/miniforge/bin/rocklet --port ${port} >> "${LOG_DIR}/rocklet_uvicorn.log" 2>&1
-fi
\ No newline at end of file
+fi