#303 follow-up: the fonts volume must mount node-owned #312

opus-5 · 2026-08-01T15:12:24+02:00

opus-5 commented

2026-08-01 15:12:24 +02:00

Follow-up to #303 (already merged).

Found on the deploy, not in a test

After #303 reached the stages, /data/fonts in the running api container was root:root. The api runs as node, so every upload would have failed with EACCES at runtime — while readyz reported ok and the whole test suite stayed green, because the suites write into a temp directory they own.

Cause

The api Dockerfile already documents the mechanism for uploads and plugins:

A fresh named volume mounted at /data/uploads or /data/plugins is created root-owned; pre-creating them here (Docker copies an image directory's ownership into a new volume on first mount) lets the non-root node user write to them.

#303 added CUSTOM_FONTS_DIR to the ENV line but not to the mkdir -p … && chown -R node:node line right below it.

Fence

A new check in the checks job asserts that every /data/… path the api image defaults to appears in BOTH the mkdir and the chown. Verified against the real defect: removing /data/fonts from the chown makes the check fail, and it passes with the fix in place.

Stage state

The customfonts volumes on test and int were created root-owned by the first deploy and must be removed so they are recreated from the fixed image. They are empty — nothing has been uploaded yet. I will do that after this merges and report the verified result.

Follow-up to #303 (already merged). ## Found on the deploy, not in a test After #303 reached the stages, `/data/fonts` in the running api container was `root:root`. The api runs as `node`, so **every upload would have failed with EACCES at runtime** — while `readyz` reported ok and the whole test suite stayed green, because the suites write into a temp directory they own. ## Cause The api Dockerfile already documents the mechanism for uploads and plugins: > A fresh named volume mounted at /data/uploads or /data/plugins is created root-owned; pre-creating them here (Docker copies an image directory's ownership into a new volume on first mount) lets the non-root `node` user write to them. #303 added `CUSTOM_FONTS_DIR` to the ENV line but not to the `mkdir -p … && chown -R node:node` line right below it. ## Fence A new check in the `checks` job asserts that every `/data/…` path the api image defaults to appears in BOTH the mkdir and the chown. Verified against the real defect: removing `/data/fonts` from the chown makes the check fail, and it passes with the fix in place. ## Stage state The `customfonts` volumes on test and int were created root-owned by the first deploy and must be removed so they are recreated from the fixed image. They are empty — nothing has been uploaded yet. I will do that after this merges and report the verified result.

opus-5 added this to the M33 — Tweaks & Feinschliff milestone 2026-08-01 15:12:24 +02:00

opus-5 added 1 commit 2026-08-01 15:12:24 +02:00

#303 follow-up: the fonts volume must mount node-owned

CI / Auth e2e pack (pull_request) Successful in 8m49s

Details

CD / Build and push images (push) Successful in 14s

Details

CD / Deploy to Test (push) Successful in 17s

Details

CD / Smoke tests against Test (push) Successful in 1m21s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 6m35s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 8m30s

Details

CI / Import/export fidelity gate (push) Successful in 57s

Details

CI / Build container images (pull_request) Successful in 2m52s

Details

CI / Lint, typecheck, test (pull_request) Successful in 6m28s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

485c8fa538

Found on the real deploy, not in any test: `/data/fonts` in the running
api container was `root:root` and the non-root `node` user could not
write to it. Every upload would have failed with EACCES at runtime while
the api reported ready.

The api Dockerfile already explains the mechanism for uploads and
plugins — Docker copies an image directory's ownership into a fresh named
volume on first mount — and pre-creates them chowned. #303 added
`CUSTOM_FONTS_DIR` to the ENV but not to that mkdir/chown line.

Adds a CI fence so it cannot recur: every `/data/…` path the api image
defaults to must also appear in the mkdir AND the chown. Verified against
the actual defect — removing `/data/fonts` from the chown makes it fail.

opus-5 merged commit 485c8fa538 into main

2026-08-01 15:29:15 +02:00

Sign in to join this conversation.

No reviewers