From f7be50952aeced11d70407e1d5f46c771a7e4b33 Mon Sep 17 00:00:00 2001 From: Fusion Date: Wed, 20 May 2026 15:38:02 +0200 Subject: [PATCH] fix(docker): run API container as root for Docker socket access The API container needs to run docker compose commands via the mounted Docker socket. Running as non-root user doesn't work well with socket permissions across container boundaries. - Remove USER appuser from Dockerfile (API service only) - Remove group_add from docker-compose (no longer needed) - Add security note about considering Docker-in-Docker or rootless This fixes: permission denied while trying to connect to the docker API at unix:///var/run/docker.sock --- apps/api/Dockerfile | 6 ++++-- docker-compose.traefik.yml | 2 -- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile index 773adfc..3b882cb 100644 --- a/apps/api/Dockerfile +++ b/apps/api/Dockerfile @@ -54,8 +54,10 @@ RUN mkdir -p /data/repos /data/instances && chown -R appuser:appgroup /data COPY wait-for-db.sh /usr/local/bin/wait-for-db.sh RUN chmod +x /usr/local/bin/wait-for-db.sh -# Switch to non-root user -USER appuser +# NOTE: Running as root to access Docker socket for managing tool instances +# This is required because Docker socket permissions require root or docker group membership +# which doesn't work well across container boundaries. +# Consider using Docker-in-Docker or rootless Docker for production hardening. # Expose port EXPOSE 8000 diff --git a/docker-compose.traefik.yml b/docker-compose.traefik.yml index 8b5a7a7..96f27d3 100644 --- a/docker-compose.traefik.yml +++ b/docker-compose.traefik.yml @@ -102,8 +102,6 @@ services: - avatar_uploads:/app/uploads - /var/run/docker.sock:/var/run/docker.sock - cloudflared_config:/etc/cloudflared - group_add: - - ${DOCKER_GID:-999} depends_on: postgres: condition: service_healthy