From cf00d7ec29be808b63b9996edbdc3f23633c2e29 Mon Sep 17 00:00:00 2001 From: Ilia Pasechnikov Date: Tue, 7 Jul 2026 23:14:56 +0900 Subject: [PATCH] fix(compose): run the dev interbox container as root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit interbox 1.4.1's image runs as non-root (uid 1000). The dev stack mounts this checkout at /workspace and keeps node_modules in a named volume — both root-owned — so bun install / the SDK-link step fail as uid 1000. Override the dev container to user 0:0; production stays non-root via the Helm chart's securityContext. Co-Authored-By: Claude Opus 4.8 (1M context) --- docker-compose.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docker-compose.yaml b/docker-compose.yaml index 6ba8f8d..ce5d1b8 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -59,6 +59,12 @@ services: # dev image the SDK rides along, so this one tag pins engine + SDK together. # To update: bump INTERBOX_VERSION, then `docker compose pull interbox && up -d`. image: ${INTERBOX_REGISTRY:-healthsamurai}/interbox:${INTERBOX_VERSION:-edge} + # The image runs as non-root (uid 1000). For local dev we mount this checkout at + # /workspace and keep node_modules in a named volume — both root-owned on the host + # side — so run the dev container as root to keep bun install / SDK-link writable. + # Production runs non-root via the Helm chart's securityContext; this override is + # dev-only convenience. + user: "0:0" depends_on: pg: condition: service_healthy