From 4a092d2e4e4d7a879fc249837193dff6369a5fde Mon Sep 17 00:00:00 2001 From: Efremenko Arhip Date: Thu, 23 Jul 2026 15:54:21 +0300 Subject: [PATCH] fix(coordinator): make artifact/log storage writable by the non-root container The container runs as uid 10001, but the ./data and ./logs bind mounts were root-owned, so blob storage failed with "mkdir .staging: permission denied" and the coordinator crash-looped. Pre-create the storage and log directories in the image owned by the coordinator user, and switch the bind mounts to named volumes, which inherit that ownership. The process can now write to them without running as root. --- coordinator/Dockerfile | 7 ++++++- coordinator/docker-compose.yml | 15 ++++++++++----- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/coordinator/Dockerfile b/coordinator/Dockerfile index bf0b1dc..fc28a60 100644 --- a/coordinator/Dockerfile +++ b/coordinator/Dockerfile @@ -33,7 +33,12 @@ FROM alpine:3.20 # ca-certificates for outbound TLS; wget backs the container healthcheck. RUN apk add --no-cache ca-certificates wget \ - && adduser -D -H -u 10001 coordinator + && adduser -D -H -u 10001 coordinator \ + # Pre-create the storage and log dirs owned by the non-root user. A named + # volume mounted here inherits this ownership from the image, so the process + # can write to it — a host bind mount, owned by root, cannot. + && mkdir -p /var/lib/scimesh/artifacts /var/log/scimesh \ + && chown -R coordinator:coordinator /var/lib/scimesh /var/log/scimesh COPY --from=build /out/coordinator /usr/local/bin/coordinator diff --git a/coordinator/docker-compose.yml b/coordinator/docker-compose.yml index 5f4c11f..901ac55 100644 --- a/coordinator/docker-compose.yml +++ b/coordinator/docker-compose.yml @@ -54,16 +54,19 @@ services: LEASE_DURATION: "2m" REAPER_INTERVAL: "30s" LOG_LEVEL: ${LOG_LEVEL:-info} - # Logs are teed to stdout (docker logs) and this rotated file, which lives - # on the mounted ./logs directory so it survives a rebuild. + # Logs are teed to stdout (docker logs) and this rotated file on a named + # volume, so they survive a rebuild. LOG_FILE: /var/log/scimesh/coordinator.log - # Artifact bytes land on the mounted ./data directory, durable across rebuilds. + # Artifact bytes live on a named volume, durable across rebuilds. COORDINATOR_STORAGE_DIR: /var/lib/scimesh/artifacts ports: - "${COORDINATOR_PORT:-8080}:8080" + # Named volumes (not host bind mounts): they inherit the image's directory + # ownership, so the non-root process can write to them. A bind mount would + # be root-owned and unwritable by uid 10001. volumes: - - ./logs:/var/log/scimesh - - ./data:/var/lib/scimesh/artifacts + - coordinator_logs:/var/log/scimesh + - coordinator_data:/var/lib/scimesh/artifacts healthcheck: test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"] interval: 10s @@ -74,3 +77,5 @@ services: volumes: pgdata: + coordinator_logs: + coordinator_data: