chore(master): run the master as nobody in the example stack (#25)

2026-10-13 09:32:09 +02:00
parent f95e5319a8
commit a838777570
5 changed files with 80 additions and 14 deletions
@@ -122,6 +122,8 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
 - **Swarm updates need manager-node API access** for the agent doing the update.
 - **The image's default entrypoint is `updater-agent`.** The master overrides it with
  `updater-master`.
+- **The example stack runs the master as nobody (`user: "65534:65534"`).** Never add `USER`
+  to the Dockerfile: the agent uses the same image and needs root for the Docker socket.
 - **The webhook waits via a broker signal plus a store re-read, with a fallback poll**
  (the broker drops signals for slow subscribers). Marking and starting jobs runs on
  `context.WithoutCancel`, so a client that disconnects cannot leave a queued job no agent