perf(docker): skip recursive chown when volume is already owned

The entrypoint ran "chown -R" on the storage volume on every container
start. Storage is a content-addressable blob store that can hold millions
of objects, so a blind recursive chown re-stats and rewrites the inode of
every blob on each boot, adding minutes of startup time and saturating the
disk on spinning media.

Guard the chown behind a top-level ownership check: only recurse when the
directory root is not already owned by the oxicloud user. The first boot
fixes a freshly mounted (root-owned) volume; every later boot is a no-op.
The same guard is applied to the static dir, factored into a shared helper.
The target UID is resolved via "id -u oxicloud" instead of hardcoding 1001.

https://claude.ai/code/session_01GpprjxjtXFYLfXNkoKnHuL

entrypoint.sh

@@ -9,14 +9,26 @@ set -e
 STORAGE_DIR="/app/storage"
 STATIC_DIR="/app/static"
 
-# Ensure the storage directory exists and is writable by oxicloud
-if [ -d "$STORAGE_DIR" ] && [ "$(id -u)" -eq 0 ]; then
-    chown -R oxicloud:oxicloud "$STORAGE_DIR"
-fi
+# Recursively chown DIR to the oxicloud user, but only when its top-level
+# entry is not already owned by that user. The storage volume is a
+# content-addressable blob store that can hold millions of objects; a blind
+# "chown -R" on every boot would re-stat and rewrite the inode of every blob,
+# turning startup into minutes of disk I/O. Checking the root entry is the
+# cheap idempotent guard: the first boot fixes a freshly mounted (root-owned)
+# volume, and every later boot is a no-op.
+ensure_owned() {
+    dir="$1"
+    if [ -d "$dir" ] && [ "$(stat -c %u "$dir")" != "$OXI_UID" ]; then
+        chown -R oxicloud:oxicloud "$dir"
+    fi
+}
 
-# Ensure static directory is readable
-if [ -d "$STATIC_DIR" ] && [ "$(id -u)" -eq 0 ]; then
-    chown -R oxicloud:oxicloud "$STATIC_DIR"
+# Only root can chown; when started unprivileged the volume permissions are
+# assumed to be correct already.
+if [ "$(id -u)" -eq 0 ]; then
+    OXI_UID="$(id -u oxicloud)"
+    ensure_owned "$STORAGE_DIR"
+    ensure_owned "$STATIC_DIR"
 fi
 
 # Drop privileges and exec the main binary (or whatever was passed as CMD)