logguard: explicit stdout/stderr paths — supervisord's auto-named childlog dir crashes it

Dockerfile

@@ -71,5 +71,7 @@ RUN sed -i 's|"theme_color": *"#009688"|"theme_color":"#eaf3ea"|; s|"background_
 # then crashes with EACCES on its first log write of the day. This supervisor
 # program runs as root and keeps the dated files cloudron-owned (see
 # assets/log-guard.sh). Remove once the host logrotate config is fixed.
+# NOTE: stdout/stderr MUST be explicit paths — supervisord's auto-named child
+# logs go to a directory that does not exist in this image and crash it.
 COPY assets/log-guard.sh /app/code/log-guard.sh
-RUN printf '[program:logguard]\ncommand=/bin/bash /app/code/log-guard.sh\nuser=root\nautorestart=true\nstartsecs=0\npriority=1\n' > /etc/supervisor/conf.d/logguard.conf
+RUN printf '[program:logguard]\ncommand=/bin/bash /app/code/log-guard.sh\nuser=root\nautorestart=true\nstartsecs=0\npriority=1\nredirect_stderr=true\nstdout_logfile=/app/data/logs/logguard.log\nstdout_logfile_maxbytes=10MB\nstdout_logfile_backups=2\n' > /etc/supervisor/conf.d/logguard.conf