chore(master): run the master as a non-root user (#25) (#27)

2026-10-13 07:33:45 +00:00
parent f95e5319a8
commit 307e46e4c7
5 changed files with 84 additions and 16 deletions
@@ -122,6 +122,8 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
 - **Swarm updates need manager-node API access** for the agent doing the update.
 - **The image's default entrypoint is `updater-agent`.** The master overrides it with
  `updater-master`.
+- **The example stack runs the master as nobody (`user: "65534:65534"`).** Never add `USER`
+  to the Dockerfile: the agent uses the same image and needs root for the Docker socket.
 - **The webhook waits via a broker signal plus a store re-read, with a fallback poll**
  (the broker drops signals for slow subscribers). Marking and starting jobs runs on
  `context.WithoutCancel`, so a client that disconnects cannot leave a queued job no agent