worker: match host docker GID (988) so the socket can stay 660HEADreleasemain

1 files changed, 12 insertions, 6 deletions

diff --git a/worker/Dockerfile b/worker/Dockerfile
index 5207d69..b8b5599 100644
--- a/worker/Dockerfile
+++ b/worker/Dockerfile
@@ -13,12 +13,18 @@ RUN cp -r /app/worker/jobs /var/lib/laminar/cfg
 # see: https://github.com/nodejs/docker-node/blame/89b29ef06b421598ec007605a2604ede0348b298/22/bullseye-slim/Dockerfile#L3-L4
 RUN chown -R node:node /var/lib/laminar
 
-# adding a user to only the group"docker" doesn't deterministically give it access to the
-# docker socket of the host.
-# e.g. host has /etc/groups: docker:995, container has /etc/groups: docker:996
-# because i'm likely the only one to ever touch this, and i FORCE "docker" to be 996, this will
-# be hardcoded defaulting to 995.
-ARG DOCKER_GID="995" # but it may be overridden via this `DOCKER_GID` build arg.
+# laminar runs as `node`, which reaches the host's docker socket only through
+# a group whose GID matches the socket's group ON THE HOST. Group names don't
+# carry across the container boundary; only the number does. If this GID is
+# wrong the worker gets "permission denied" on the socket, and the tempting
+# fix - chmod 777 on the host socket - hands root on the host to every process
+# and container there, not just CI.
+#
+# Set this to the output of `getent group docker | cut -d: -f3` on the host
+# running the worker (liz.coffee: 988). Override with --build-arg DOCKER_GID=.
+# (Coolify drops --group-add from custom docker options, so it can't be
+# supplied at runtime there.)
+ARG DOCKER_GID="988"
 RUN groupadd -g ${DOCKER_GID} docker
 RUN usermod -a -d /var/lib/laminar -G docker node