Changed
- ♻️ Native Python I/O for multi-user reads — replaced subprocess-based file reads (
cat,find -printf,stat -c,test) with nativeaiofiles/oscalls. Home directories now usechmod 750with group membership so the server can read directly. Writes still usesudo -ufor correct ownership. Cross-user isolation preserved via Unix group permissions. - 🐳 Dockerfile — grants
CAP_SETGIDto the Python binary viasetcapso the server can refresh supplementary groups at runtime when provisioning new users.