Cli: fix docker run on linux

bin/get-cli.sh

@@ -45,18 +45,7 @@ echo "                   |___/                                    ";
 
 
 get_latest_release_tarball_url() {
-  if ! command -v jq > /dev/null; then
-  	echo "Not found."
-  	echo "======================================================================================================"
-  	echo " Please install jq on your system using your favourite package manager."
-  	echo ""
-  	echo " Restart after installing jq."
-  	echo "======================================================================================================"
-  	echo " In alternative you can set a fixed LangStream CLI version by setting LANGSTREAM_CLI_URL."
-    echo "======================================================================================================"
-  	echo ""
-  	exit 1
-  fi
+
    curl -Ss https://api.github.com/repos/LangStream/langstream/releases/latest | jq -r '.assets[] | select((.name | contains("langstream-cli")) and (.name | contains(".zip"))) | .browser_download_url'
 }
 
@@ -69,6 +58,17 @@ echo ""
 echo "$(tput setaf 6)Checking archive:$(tput setaf 7)"
 if [ -z "$LANGSTREAM_CLI_URL" ]; then
   echo "$(tput setaf 2)LANGSTREAM_CLI_URL$(tput setaf 7) environment not set, checking for the latest release"
+  if ! command -v jq > /dev/null; then
+    	echo "======================================================================================================"
+    	echo " Please install jq on your system using your favourite package manager."
+    	echo ""
+    	echo " Restart after installing jq."
+    	echo "======================================================================================================"
+    	echo " In alternative you can set a fixed LangStream CLI version by setting LANGSTREAM_CLI_URL."
+      echo "======================================================================================================"
+    	echo ""
+    	exit 1
+  fi
   LANGSTREAM_CLI_URL=$(get_latest_release_tarball_url)
   echo "$(tput setaf 2)[OK]$(tput setaf 7) - Using $LANGSTREAM_CLI_URL"
 else
@@ -101,7 +101,6 @@ esac
 echo "$(tput setaf 2)[OK]$(tput setaf 7) - Ready to install $(basename $downloaded_extracted_dir)."
 
 if ! command -v unzip > /dev/null; then
-	echo "Not found."
 	echo "======================================================================================================"
 	echo " Please install unzip on your system using your favourite package manager."
 	echo ""
@@ -113,7 +112,6 @@ fi
 echo "$(tput setaf 2)[OK]$(tput setaf 7) - unzip command is available"
 
 if ! command -v curl > /dev/null; then
-	echo "Not found."
 	echo ""
 	echo "======================================================================================================"
 	echo " Please install curl on your system using your favourite package manager."

conf/cli.yaml

@@ -23,7 +23,7 @@ profiles:
   local-docker-run:
     webServiceUrl: "http://localhost:8090"
     apiGatewayUrl: "ws://localhost:8091"
-    tenant: "local-docker-run"
+    tenant: "default"
     token: null
     name: "local-docker-run"
 currentProfile: "default"

langstream-cli/src/main/java/ai/langstream/cli/commands/BaseCmd.java

@@ -441,6 +441,7 @@ public static File downloadHttpsFile(
                             + response.body());
         }
         Files.write(tempFile, response.body());
+        tempFile.toFile().setReadable(true, false);
         final long time = (System.currentTimeMillis() - start) / 1000;
         logger.accept(String.format("downloaded remote file %s (%d s)", path, time));
         return tempFile.toFile();

langstream-cli/src/main/java/ai/langstream/cli/commands/docker/LocalRunApplicationCmd.java

@@ -27,6 +27,7 @@
 import ai.langstream.cli.commands.applications.UIAppCmd;
 import ai.langstream.cli.util.LocalFileReferenceResolver;
 import java.io.File;
+import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -281,12 +282,10 @@ private void executeOnDocker(
             boolean startDatabase,
             boolean dryRun)
             throws Exception {
-        File tmpInstanceFile = Files.createTempFile("instance", ".yaml").toFile();
-        Files.write(tmpInstanceFile.toPath(), instanceContents.getBytes(StandardCharsets.UTF_8));
+        File tmpInstanceFile = createReadableTempFile("instance", instanceContents);
         File tmpSecretsFile = null;
         if (secretsContents != null) {
-            tmpSecretsFile = Files.createTempFile("secrets", ".yaml").toFile();
-            Files.write(tmpSecretsFile.toPath(), secretsContents.getBytes(StandardCharsets.UTF_8));
+            tmpSecretsFile = createReadableTempFile("secrets", secretsContents);
         }
         String imageName = dockerImageName + ":" + dockerImageVersion;
         List<String> commandLine = new ArrayList<>();
@@ -381,6 +380,14 @@ private void executeOnDocker(
         }
     }
 
+    private static File createReadableTempFile(String prefix, String instanceContents)
+            throws IOException {
+        File tempFile = Files.createTempFile(prefix, ".yaml").toFile();
+        tempFile.setReadable(true, false);
+        Files.write(tempFile.toPath(), instanceContents.getBytes(StandardCharsets.UTF_8));
+        return tempFile;
+    }
+
     private void startUI(String tenant, String applicationId, Path outputLog, Process process) {
         String body;
         try (final AdminClient localAdminClient =

langstream-cli/src/test/java/ai/langstream/cli/commands/docker/LocalRunApplicationCmdTest.java

@@ -19,9 +19,17 @@
 
 import ai.langstream.cli.NamedProfile;
 import ai.langstream.cli.commands.applications.CommandTestBase;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 import org.junit.jupiter.api.Test;
 
@@ -30,11 +38,21 @@ class LocalRunApplicationCmdTest extends CommandTestBase {
     @Test
     void testArgs() throws Exception {
         final Path tempDir = Files.createTempDirectory(this.tempDir, "langstream");
+        final Path secrets = Files.createTempFile("langstream", ".yaml");
+        Files.write(secrets, "secrets: []".getBytes(StandardCharsets.UTF_8));
 
         final String appDir = tempDir.toFile().getAbsolutePath();
         CommandResult result =
                 executeCommand(
-                        "docker", "run", "my-app", "-app", appDir, "--docker-command", "echo");
+                        "docker",
+                        "run",
+                        "my-app",
+                        "-app",
+                        appDir,
+                        "-s",
+                        secrets.toFile().getAbsolutePath(),
+                        "--docker-command",
+                        "echo");
         assertEquals("", result.err());
         assertEquals(0, result.exitCode());
 
@@ -57,10 +75,47 @@ void testArgs() throws Exception {
                                 + "-p 8090:8090 "
                                 + "ghcr.io/langstream/langstream-runtime-tester:unknown"));
 
+        final List<String> volumes = extractVolumes(lastLine);
+        assertEquals(3, volumes.size());
+        volumes.forEach(
+                volume -> {
+                    final String hostPath = volume.split(":")[0];
+                    final File file = new File(hostPath);
+                    assertTrue(file.exists());
+                    if (!Files.isDirectory(file.toPath())) {
+                        final Set<PosixFilePermission> posixFilePermissions;
+                        try {
+                            posixFilePermissions = Files.getPosixFilePermissions(file.toPath());
+                            System.out.println(
+                                    "permissions: " + posixFilePermissions + " for " + file);
+                            assertTrue(
+                                    posixFilePermissions.contains(PosixFilePermission.OTHERS_READ));
+                            assertTrue(
+                                    posixFilePermissions.contains(PosixFilePermission.OWNER_READ));
+                            assertTrue(
+                                    posixFilePermissions.contains(PosixFilePermission.GROUP_READ));
+                        } catch (IOException e) {
+                            throw new RuntimeException(e);
+                        }
+                    }
+                });
+
         final NamedProfile namedProfile = getConfig().getProfiles().get("local-docker-run");
         assertNotNull(namedProfile);
         assertEquals("default", namedProfile.getTenant());
         assertEquals("http://localhost:8090", namedProfile.getWebServiceUrl());
         assertEquals("ws://localhost:8091", namedProfile.getApiGatewayUrl());
     }
+
+    private static List<String> extractVolumes(String input) {
+        List<String> volumes = new ArrayList<>();
+        Pattern pattern = Pattern.compile("-v\\s+([^\\s]+)");
+        Matcher matcher = pattern.matcher(input);
+
+        while (matcher.find()) {
+            volumes.add(matcher.group(1));
+        }
+
+        return volumes;
+    }
 }