feat: entrypoint for safe config + permissions; optional counter seeding via USE_INITIAL_COUNTERS

Dockerfile

@@ -1,33 +1,35 @@
-# Multi-stage für kleinere finale Imagegröße
-FROM python:3.12-slim AS base
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1
-
-# System deps (tzdata optional falls benötigt)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-# Non-root user
-RUN useradd -u 10001 -m appuser
-
-WORKDIR /app
-
-COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
-
-COPY bot.py ./
-COPY config.example.yaml ./config.yaml
-
-# Datenverzeichnis
-RUN mkdir -p /data && chown -R appuser:appuser /data && chown appuser:appuser /app
-VOLUME ["/data"]
-
-USER appuser
-
-ENV DATA_DIR=/data \
-    CONFIG_FILE=/app/config.yaml
-
-CMD ["python", "bot.py"]
+# Multi-stage für kleinere finale Imagegröße
+FROM python:3.12-slim AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
+
+# System deps (tzdata optional falls benötigt)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Non-root user
+RUN useradd -u 10001 -m appuser
+
+WORKDIR /app
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY bot.py ./
+COPY config.example.yaml ./config.example.yaml
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
+# Datenverzeichnis
+# Pre-create data dir (ownership may be adjusted again at runtime by entrypoint)
+RUN mkdir -p /data
+VOLUME ["/data"]
+
+ENV DATA_DIR=/data \
+    CONFIG_FILE=/app/config.yaml
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+CMD ["python", "bot.py"]