fix: use runuser for privilege drop and capture container stderr in logs

The container still exited immediately after the su-based fix.  can
interfere with TTY/stdin handling for interactive shells. Switch to
, which is root-only, skips PAM, and preserves file descriptors so
bash stays interactive.

Also improve container failure diagnostics:
-  now combines stdout and stderr
- This helps surface the real reason when a container exits with code 0

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files
This commit is contained in:
Developer
2026-06-15 10:41:37 +00:00
parent e35e605914
commit 1d345eba32
20 changed files with 81 additions and 34 deletions
+1 -1
View File
@@ -2,7 +2,7 @@
dir: apps/api/src
## role
Core backend API package for the "Headquarter" service, handling configuration, database connectivity, structured logging, and FastAPI application initialization.
Core application package for the Headquarter API, handling configuration, database connectivity, logging infrastructure, and FastAPI application lifecycle.
## parent
index: apps/api/.pi-map.index.md
map: apps/api/.pi-map.md