fix: use build time ARGs instead of run time ENVs

[joedwards32]

fix: use build time ARGs instead of run time ENVs to declare sensitive values and protect them from manipulation by opinionated container runtimes

[cowrevenge]

Fully deleted the setup and started over and the "//" and disk write errors still exist with this release.

Vanilla CS2 is fully tested and working. No errors. Only occures on Joedwards32 without the home patch.

#!/bin/bash

Pelican install prep for CS2 under /home/container

Enforces uid:gid 999:999 and verifies ownership/writeability.

set -euo pipefail
umask 002

RUID=999
RGID=999

export LANG=C.UTF-8
export LC_ALL=C.UTF-8
export LANGUAGE=en_US:en

ROOT_DIR="/home/container"
STEAMAPPDIR="${ROOT_DIR}/Steam"
INSTALL_DIR="${STEAMAPPDIR}/cs2-dedicated"

echo "Using ROOT_DIR=${ROOT_DIR}"
echo "Using STEAMAPPDIR=${STEAMAPPDIR}"
echo "Install dir: ${INSTALL_DIR}"

Create tree

mkdir -p
"${ROOT_DIR}"
"${ROOT_DIR}/"{steamcmd,steamapps,.steam/sdk32,.steam/sdk64}
"${STEAMAPPDIR}"/{logs,cs2-dedicated}
"${INSTALL_DIR}/game/csgo/cfg"

Normalize steamapps and compat link

if [ -d "${STEAMAPPDIR}/steamapps" ] && [ ! -L "${STEAMAPPDIR}/steamapps" ]; then
rsync -aH --remove-source-files "${STEAMAPPDIR}/steamapps/" "${ROOT_DIR}/steamapps/" || {
echo "ERROR: migrate Steam/steamapps -> steamapps failed"; exit 1; }
rmdir "${STEAMAPPDIR}/steamapps" 2>/dev/null || true
fi
ln -sfn "../steamapps" "${STEAMAPPDIR}/steamapps" || {
echo "ERROR: symlink Steam/steamapps -> ../steamapps failed"; exit 1; }

Perms and ownership (MANDATORY 999:999)

chmod -R u+rwX,g+rwX "${ROOT_DIR}" || { echo "ERROR: chmod ${ROOT_DIR}"; exit 1; }
chown -R ${RUID}:${RGID} "${ROOT_DIR}" || {
echo "ERROR: chown to ${RUID}:${RGID} failed; mount may block chown"; exit 1; }

Verify ownership on critical paths (must be 999:999)

for p in "${ROOT_DIR}" "${STEAMAPPDIR}" "${INSTALL_DIR}" "${INSTALL_DIR}/game/csgo/cfg" ; do
ow="$(stat -c '%u:%g' "$p" 2>/dev/null || echo '?:?')"
if [ "$ow" != "${RUID}:${RGID}" ]; then
echo "ERROR: $p ownership is $ow, expected ${RUID}:${RGID}"
exit 1
fi
done

atomic permcheck owned by 999:999

install -o ${RUID} -g ${RGID} -m 664 /dev/null "${INSTALL_DIR}/.permcheck"
printf 'permcheck %s\n' "$(date -u +%FT%TZ)" >> "${INSTALL_DIR}/.permcheck"
ow_chk="$(stat -c '%u:%g' "${INSTALL_DIR}/.permcheck")"
[ "$ow_chk" = "${RUID}:${RGID}" ] || { echo "ERROR: ${INSTALL_DIR}/.permcheck is $ow_chk, expected ${RUID}:${RGID}"; exit 1; }

Runtime env

export HOME="${ROOT_DIR}"

Summary

echo "Prep complete."
echo "HOME: ${HOME}"
echo "Ownership enforced: ${RUID}:${RGID}"
echo "Install dir ready: ${INSTALL_DIR}"
echo "CFG dir: ${INSTALL_DIR}/game/csgo/cfg"
echo "Logs dir: ${STEAMAPPDIR}/logs"
echo "Compat link: ${STEAMAPPDIR}/steamapps -> ../steamapps"

[joedwards32]

PR updated to parameterize more, allowing for a pelican compatible build like

docker build --build-arg USER=container --build-arg PUID=999 --build-arg PGID=988 sniper