From 3805be7b42f6954c78a84dd799fad14b7c0eba5f Mon Sep 17 00:00:00 2001
From: Liosha84 <Liosha84@gmail.com>
Date: Thu, 5 Nov 2026 03:53:55 +0100
Subject: [PATCH] =?UTF-8?q?Dockerfile:=20=D1=81=D0=B2=D0=BE=D0=B9=20=D0=BF?=
 =?UTF-8?q?=D0=BE=D0=BB=D1=8C=D0=B7=D0=BE=D0=B2=D0=B0=D1=82=D0=B5=D0=BB?=
 =?UTF-8?q?=D1=8C=20app=20(uid=2010001)=20=E2=80=94=20mail=20=D0=B2=20Alpi?=
 =?UTF-8?q?ne=20=D1=83=D0=B6=D0=B5=20=D0=B5=D1=81=D1=82=D1=8C,=20addgroup?=
 =?UTF-8?q?=20=D0=BF=D0=B0=D0=B4=D0=B0=D0=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

α
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/Dockerfile           | 7 ++++---
 docker-compose.jambotron.yml | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/backend/Dockerfile b/backend/Dockerfile
index 63f1fb6..eab332b 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -20,11 +20,12 @@ RUN chmod +x gradlew && ./gradlew :backend:bootJar --no-daemon -x test
 
 # 3. Runtime: not root; data in /app/data (volume)
 FROM eclipse-temurin:21-jre-alpine
-RUN apk add --no-cache curl && addgroup -S mail && adduser -S -G mail mail \
-    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R mail:mail /app/data
+# own user: "mail" already exists in Alpine (uid 8, group 12) — addgroup mail fails
+RUN apk add --no-cache curl && addgroup -S -g 10001 app && adduser -S -u 10001 -G app app \
+    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R app:app /app/data
 WORKDIR /app
 COPY --from=build /app/backend/build/libs/*.jar app.jar
-USER mail
+USER app
 ENV MAIL_ATTACHMENTS_DIR=/app/data/attachments DKIM_KEYS_DIR=/app/data/dkim-keys
 EXPOSE 8080 3025
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
diff --git a/docker-compose.jambotron.yml b/docker-compose.jambotron.yml
index 7be8a75..73faa89 100644
--- a/docker-compose.jambotron.yml
+++ b/docker-compose.jambotron.yml
@@ -17,7 +17,7 @@ services:
         for name in DB_PASSWORD JWT_SECRET; do
           [ -s /secrets/$$name ] || head -c 48 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' > /secrets/$$name
         done
-        # postgres reads it as uid 70, the app as "mail" — readable inside these containers only
+        # postgres reads it as uid 70, the app as uid 10001 — readable inside these containers only
         chmod 644 /secrets/DB_PASSWORD /secrets/JWT_SECRET
     volumes:
       - secrets:/secrets