• Add Docker TAGLINE environment variable for modern UI customization
• Implement tagline templating in entrypoint with HTML/sed escaping
• Set default tagline in both Dockerfile and Dockerfile.alpine
• Extend E2E tests to verify custom and default tagline rendering
• Update Docker documentation with TAGLINE variable and compose example

Add TAGLINE templating with escaping logic

• Added TAGLINE environment variable processing block after TITLE handling
• Normalize multiline tagline input to single line (remove carriage returns and newlines)
• HTML-escape the tagline content for safe rendering
• Sed-escape the tagline for safe regex replacement
• Replace default tagline in index-modern.html with custom value using sed

docker/entrypoint.sh

Set default TAGLINE environment variable

• Added ENV TAGLINE with default value matching original hardcoded tagline
• Placed after TITLE environment variable for consistency

Dockerfile

Set default TAGLINE environment variable

• Added ENV TAGLINE with default value matching original hardcoded tagline
• Placed after TITLE environment variable for consistency

Dockerfile.alpine

Description

docker/entrypoint.sh replaces the modern tagline using a sed expression delimited by #, but
the replacement text is not escaped for #. Since html_escape converts ' into ' (contains
#), setting TAGLINE with an apostrophe will make sed fail and (due to set -e) prevent the
container from starting.

Code

docker/entrypoint.sh[R113-118]

+  if [ -n "$TAGLINE" ]; then
+    TAGLINE_ONE_LINE=${TAGLINE//$'\r'/}
+    TAGLINE_ONE_LINE=${TAGLINE_ONE_LINE//$'\n'/ }
+    TAGLINE_HTML_ESCAPED=$(html_escape "$TAGLINE_ONE_LINE")
+    TAGLINE_ESCAPED=$(sed_escape "$TAGLINE_HTML_ESCAPED")
+    sed -i "s#<p class=\"tagline\">No Flash, No Java, No Websockets, No Bullsh\\*t<\\/p>#<p class=\"tagline\">$TAGLINE_ESCAPED<\\/p>#g" /var/www/html/index-modern.html

Evidence

The sed command uses # as its delimiter for the TAGLINE replacement, but sed_escape() only
escapes &, /, \, and $, not #. Additionally, html_escape() turns single quotes into the
numeric entity ', which introduces a literal # into the replacement string, breaking the
s#...#...# sed command and causing the entrypoint to exit because set -e is enabled.

docker/entrypoint.sh[13-13]
docker/entrypoint.sh[20-27]
docker/entrypoint.sh[29-31]
docker/entrypoint.sh[112-119]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The TAGLINE sed replacement uses `#` as the delimiter, but the escaping helper `sed_escape()` does not escape `#`. After `html_escape()`, any apostrophe becomes `'` which contains `#`, breaking the sed expression and aborting the entrypoint due to `set -e`.

## Issue Context
This impacts runtime container startup whenever a user sets `TAGLINE` containing `'` (a common character), because the entrypoint script exits on sed errors.

## Fix Focus Areas
- docker/entrypoint.sh[20-31]
- docker/entrypoint.sh[112-119]

## Suggested fix
Pick one:
1) **Escape `#` in `sed_escape()`** (safe for existing callers): extend the character class to include `#` (and keep existing escapes).
2) **Switch TAGLINE sed back to `/` delimiter** (since `sed_escape()` already escapes `/`), avoiding the need for `#` escaping.

After implementing, add/adjust an E2E case where TAGLINE includes an apostrophe (e.g., `Don't`) to prevent regression.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools