audit 5: the supervisor socket the panel's alone, OpenDKIM logs and oversigns From

M17: the supervisord control socket is root:supervisor 0770, a group whose
one member is the panel; OpenDKIM and Postfix keep `selfpost` for the files
under /data and no longer reach the socket.

L30, read in OpenDKIM 2.11.0~beta2's source first: it logs through
syslog(3) only and has no Logfile option, and nothing in the container
served /dev/log. internal/syslogrelay (the panel binary with
-syslog-relay=/run/syslog/log, program syslog-relay before OpenDKIM,
/dev/log a link to its socket) passes the datagrams to stdout, error and
worse marked. opendkim.conf: Syslog yes, Canonicalization relaxed/simple,
OversignHeaders From (RFC 6376 § 3.4, § 8.15). e2e: OpenDKIM's start line
reaches the container log; every program RUNNING; DKIM verifies.

Tested on the test server: go vet + go test of 26 packages, make e2e (all
pass, 626 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/entrypoint.sh

@@ -180,6 +180,17 @@ chmod 2750 /run/opendkim /run/selfpost
 # (test(1), -S: true for any socket file, whether or not anything listens.)
 rm -f /run/opendkim/*.sock /run/selfpost/*.sock /run/selfpost/*.alive
 
+# The container's /dev/log: a link to the socket the syslog-relay program (the
+# panel's binary, as `panel`) listens on, so what OpenDKIM logs through
+# syslog(3) reaches the container's log (build/supervisord.conf; audit
+# 2026-10-12, L30). The directory is the relay's and reachable by all: the
+# socket is the container's local log, as /dev/log is on a host.
+mkdir -p /run/syslog
+chown panel:panel /run/syslog
+chmod 0755 /run/syslog
+rm -f /run/syslog/log
+ln -sfn /run/syslog/log /dev/log
+
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the
 # optional 587 service are all driven by env at run time, and re-derived on every