Run as PUID:PGID with a configurable umask

The image now starts through docker-entrypoint.sh: as root it hands
/data and the backup folder to PUID:PGID (only files owned by someone
else, so restarts stay fast), applies UMASK, and runs Canon as that
user with su-exec. Started with --user, it runs Canon directly. The
image defaults to 1000:1000; the Compose file presets Unraid's 99:100.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Runs Canon as PUID:PGID (default 1000:1000) so files it creates on mounted
+# folders belong to that user, e.g. 99:100 (nobody:users) on Unraid.
+set -eu
+
+PUID="${PUID:-1000}"
+PGID="${PGID:-1000}"
+UMASK="${UMASK:-022}"
+
+case "$PUID$PGID" in
+  *[!0-9]*) echo "canon: PUID and PGID must be numbers (got PUID=$PUID PGID=$PGID)" >&2; exit 1 ;;
+esac
+case "$UMASK" in
+  *[!0-7]*) echo "canon: UMASK must be octal, like 022 or 002 (got $UMASK)" >&2; exit 1 ;;
+esac
+umask "$UMASK"
+
+# Started with `user:` set in Compose or `--user`: nothing to switch.
+if [ "$(id -u)" != 0 ]; then
+  exec canon "$@"
+fi
+
+data="${CANON_DATA_DIR:-/data}"
+backups="${CANON_BACKUP_DIR:-$data/backups}"
+for dir in "$data" "$backups"; do
+  mkdir -p "$dir"
+  # Only touch what's owned by someone else, so restarts stay fast.
+  if ! find "$dir" \( ! -user "$PUID" -o ! -group "$PGID" \) -exec chown "$PUID:$PGID" {} + 2>/dev/null; then
+    echo "canon: couldn't give $PUID:$PGID ownership of everything in $dir (a network share?); continuing" >&2
+  fi
+done
+
+export HOME="$data"
+exec su-exec "$PUID:$PGID" canon "$@"