fix(ci): let the preview webapp start its nginx workers

[FelixTJDietrich]

Description

The first preview to get this far crash-looped in its SPA container:

nginx: [emerg] chown("/var/cache/nginx/client_temp", 101) failed (1: Operation not permitted)

cap_drop: ALL leaves nginx's master unable to prepare its cache directories. This is a latent bug from the original hardening rather than a regression: the webapp depends_on the application server being healthy, and until #1566 no preview ever reached that point, so the container had never actually started.

CHOWN alone is not enough, and it fails in the worst way — the master survives and reports start worker processes, then every worker exits:

[alert] 1#1: worker process 46 exited with fatal code 2 and cannot be respawned

leaving a container Docker still calls running while it serves nothing. nginx runs its workers as the nginx user, so it needs SETGID and SETUID too. That is the same shape as the PostgreSQL entry already in the allowlist, and the allowlist comment now says what the two have in common instead of listing one of them.

How to test

Measured against the published image on the staging host, not reasoned about — two containers side by side, 20 seconds each:

capabilities	result
cap_drop: ALL	chown(...) failed (1: Operation not permitted)
+ CHOWN	master up, workers dead: fatal code 2 and cannot be respawned
+ CHOWN, SETGID, SETUID	start worker process 45, 46, 47 — stays up

bun run format and bun run check are green; check-preview-stack.ts still fails on any capability not in the allowlist.

This pull request cannot preview itself — the controller refuses any head that edits docker/preview/** — so #1538 redeploying after merge is the end-to-end test. Everything ahead of the SPA already works there: the seed loader clones and silences staging's data, and the application server is healthy against it and against staging's broker.

Checklist

• My changeset summary reads as an operator/user-facing note — empty changeset: previews have not reached a release, so this fixes behaviour before anyone runs it
• If the operator must act on this change, the changeset says how — no operator action

[coderabbitai]

Warning

Review limit reached

Next included review available in 17 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bb2b9495-b94f-4f0d-a441-867dd1f810c6

📥 Commits

Reviewing files that changed from the base of the PR and between e7ff564 and 0292380.

📒 Files selected for processing (3)

• .changeset/previews-serve-their-frontend.md
• docker/preview/compose.app.yaml
• scripts/check-preview-stack.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)

[github-actions]

🧩 Storybook Preview

Review this pull request's components and interaction states:

🔗 View Storybook Preview

_{Preview for commit 0292380. Updates automatically on new commits.}