docs: README FileBrowser umask + REPORT for userdata-arc close-out (v0.66.2)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-15 08:29:02 +02:00
parent 98d5504097
commit 1201dcbab7
2 changed files with 66 additions and 74 deletions
@@ -715,7 +715,11 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
 >     auto-creates a userdata dir as guest-root (covers apps not in the skeleton).
 >   - **FileBrowser** mounts `<drive>/userdata` (was `appdata`) and runs as uid 1000 → it can create
 >     folders + upload into the 2775 setgid tree (fixes the old permission-denied); app internals
->     (`appdata/`) are no longer browsable.
+>     (`appdata/`) are no longer browsable. **(v0.66.2)** its entrypoint is wrapped
+>     `["sh","-c","umask 002; exec /home/filebrowser/filebrowser"]` so folders the customer creates come
+>     out **2775 (group-writable)** — the gtstef image is a single Go binary that ignores a `UMASK` env
+>     (verified), so the wrapper is the mechanism. Without it, customer folders were 2755 (group-read
+>     only) and apps in group 1000 couldn't write into them.
 >   - **Run-identity**: PUID/PGID-1000 apps (radarr/sonarr/calibre with `UMASK=002`) write **group-
 >     writable**, so FileBrowser can fully manage their output. Root-only apps (jellyfin :ro; komga +
 >     audiobookshelf RW after the `user:1000` fallback) write **group-readable** via setgid (FileBrowser