From 5c8e1e038e0dba7b26eeaffe7ac9ff6ca8060b01 Mon Sep 17 00:00:00 2001 From: Elizabeth Alexander Hunt Date: Wed, 23 Sep 2026 20:02:20 -0700 Subject: worker: match host docker GID (988) so the socket can stay 660 --- worker/Dockerfile | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) (limited to 'worker') diff --git a/worker/Dockerfile b/worker/Dockerfile index 5207d69..b8b5599 100644 --- a/worker/Dockerfile +++ b/worker/Dockerfile @@ -13,12 +13,18 @@ RUN cp -r /app/worker/jobs /var/lib/laminar/cfg # see: https://github.com/nodejs/docker-node/blame/89b29ef06b421598ec007605a2604ede0348b298/22/bullseye-slim/Dockerfile#L3-L4 RUN chown -R node:node /var/lib/laminar -# adding a user to only the group"docker" doesn't deterministically give it access to the -# docker socket of the host. -# e.g. host has /etc/groups: docker:995, container has /etc/groups: docker:996 -# because i'm likely the only one to ever touch this, and i FORCE "docker" to be 996, this will -# be hardcoded defaulting to 995. -ARG DOCKER_GID="995" # but it may be overridden via this `DOCKER_GID` build arg. +# laminar runs as `node`, which reaches the host's docker socket only through +# a group whose GID matches the socket's group ON THE HOST. Group names don't +# carry across the container boundary; only the number does. If this GID is +# wrong the worker gets "permission denied" on the socket, and the tempting +# fix - chmod 777 on the host socket - hands root on the host to every process +# and container there, not just CI. +# +# Set this to the output of `getent group docker | cut -d: -f3` on the host +# running the worker (liz.coffee: 988). Override with --build-arg DOCKER_GID=. +# (Coolify drops --group-add from custom docker options, so it can't be +# supplied at runtime there.) +ARG DOCKER_GID="988" RUN groupadd -g ${DOCKER_GID} docker RUN usermod -a -d /var/lib/laminar -G docker node -- cgit v1.3