#!/bin/sh
# Dev container entrypoint.
#
# Starts as root only long enough to fix the writable bind/volume ownership,
# then installs Composer dependencies as the unprivileged www-data user.
# Running `composer install` as root would let a malicious or compromised
# package execute its install scripts with full container privileges (CWE-250).
set -e

# The vendor directory is a Docker volume that may be root-owned on first run;
# make it writable by www-data before installing as that user.
mkdir -p /var/www/html/vendor
chown www-data:www-data /var/www/html/vendor

# Install dependencies as www-data (COMPOSER_HOME under /tmp is world-writable).
su -s /bin/sh www-data -c 'cd /var/www/html && COMPOSER_HOME=/tmp/composer composer install --no-interaction'

# Hand off to Apache. apache2-foreground runs the master as root solely to bind
# port 80, then drops every request-handling worker to www-data via Apache's
# standard privilege separation — so the PHP application, and any RCE within it,
# runs unprivileged.
exec apache2-foreground