fix(docker): make the git-checkout volume writable, in both stacks

A new named volume is created root-owned, and one created by an earlier
image keeps that image's uid. Staging's is 100:101 at 0755 while the
buildpack image runs as 1002:1001, so the agent could not create its
content-addressed store:

  Failed to lock CAS blob 0a603c06...
  Caused by: java.nio.file.AccessDeniedException: /data/git-repos/cas

Nothing writes there until an agent job runs, so the deployment reported
healthy and the first practice review failed.

chown -Rh, not a find predicate: -h retargets the dangling symlinks the
tree contains instead of following them out of the volume, and the
predicate it replaces skipped the group entirely, so it did not do what it
claimed. The preview stack gets the same text and the same command — it had
drifted to chown -R, which has the symlink hole.

volume-init is a dependency of both application roles, so it runs on every
start: network_mode none because it needs no networking, a logging cap
because every sibling has one, and a digest-pinned base because an
unpinned tag in that position can block the stack from starting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EZADQeSx6zQNNqsdu7AAqZ

Author: FelixTJDietrich

docker/compose.app.yaml

@@ -75,21 +75,25 @@ services:
         max-size: "50m"
         max-file: "5"
 
-  # A named volume is created root-owned, and one created by an earlier image keeps that image's
-  # uid. The buildpack image runs as `cnb` (1002:1001), so anything it must write under
-  # /data/git-repos — the git checkouts and the agent's content-addressed store — is unwritable
-  # until the ownership matches. That surfaces as AccessDeniedException on the first practice
-  # review rather than at startup, because nothing writes there until an agent job runs. Only
-  # entries with the wrong owner are touched, so an already-correct volume costs a metadata walk.
+  # A new named volume is created root-owned, and one created by an earlier image keeps that image's
+  # uid. The buildpack image runs as `cnb` (1002:1001), so nothing under /data/git-repos is writable
+  # until the ownership matches — and that surfaces when an agent job first writes there, not at
+  # startup. -h so a symlink inside a checkout is retargeted rather than followed out of the volume.
   volume-init:
-    image: alpine:3
+    image: alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
     command:
       - sh
       - -c
-      - "find /data/git-repos ! -user 1002 -exec chown -h 1002:1001 {} + && chmod 0755 /data/git-repos"
+      - "chown -Rh 1002:1001 /data/git-repos && chmod 0755 /data/git-repos"
     volumes:
       - git-repos:/data/git-repos
     restart: "no"
+    network_mode: none
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "5"
 
   # See docs/admin/agent-image-digests.md.
   release-pin-fetcher:
@@ -293,10 +297,8 @@ services:
       volume-init:
         condition: service_completed_successfully
     restart: unless-stopped
-    # The image runs unprivileged (the buildpack's `cnb` user) while /var/run/docker.sock is
-    # root:docker 0660, so the sandbox runtime cannot reach the daemon without joining the host's
-    # docker group. There is no portable value: read the host's with
-    # `getent group docker | cut -d: -f3` and set DOCKER_GROUP_ID to it.
+    # Joins the host's docker group so the unprivileged image can reach root:docker 0660
+    # /var/run/docker.sock. Host-specific — see DOCKER_GROUP_ID in .env.example.
     group_add:
       - "${DOCKER_GROUP_ID:-999}"
     volumes:
@@ -434,10 +436,8 @@ services:
       volume-init:
         condition: service_completed_successfully
     restart: unless-stopped
-    # The image runs unprivileged (the buildpack's `cnb` user) while /var/run/docker.sock is
-    # root:docker 0660, so the sandbox runtime cannot reach the daemon without joining the host's
-    # docker group. There is no portable value: read the host's with
-    # `getent group docker | cut -d: -f3` and set DOCKER_GROUP_ID to it.
+    # Joins the host's docker group so the unprivileged image can reach root:docker 0660
+    # /var/run/docker.sock. Host-specific — see DOCKER_GROUP_ID in .env.example.
     group_add:
       - "${DOCKER_GROUP_ID:-999}"
     volumes:

docker/preview/compose.app.yaml

@@ -197,18 +197,20 @@ services:
           cpus: "0.5"
           memory: 512M
 
-  # Docker creates named volumes as root:root; the buildpack image runs as `cnb` (1002:1001) and
-  # needs to write git checkouts and Tomcat access logs. Every deploy gets fresh volumes, so the
-  # ownership fix has to run on every deploy too.
+  # A new named volume is created root-owned, and one created by an earlier image keeps that image's
+  # uid. The buildpack image runs as `cnb` (1002:1001), so nothing under /data/git-repos is writable
+  # until the ownership matches — and that surfaces when an agent job first writes there, not at
+  # startup. -h so a symlink inside a checkout is retargeted rather than followed out of the volume.
   volume-init:
-    image: alpine:3
+    image: alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
     command:
       - sh
       - -c
-      - chown -R 1002:1001 /data/git-repos && chmod 0755 /data/git-repos
+      - "chown -Rh 1002:1001 /data/git-repos && chmod 0755 /data/git-repos"
     volumes:
       - git-repos:/data/git-repos
     restart: "no"
+    network_mode: none
 
   # The service name must stay dash-free. Coolify stores a service's configured domain under the
   # service name but looks it up with dashes replaced by underscores, so a dashed name never
@@ -347,10 +349,8 @@ services:
       WEBHOOK_EXTERNAL_URL: ${WEBHOOK_EXTERNAL_URL:-https://staging.hephaestus.aet.cit.tum.de}
       THC_PORT: "8080"
       THC_PATH: /actuator/health/liveness
-    # The image runs unprivileged (the buildpack's `cnb` user) while /var/run/docker.sock is
-    # root:docker 0660, so the sandbox runtime cannot reach the daemon without joining the host's
-    # docker group. There is no portable value: read the host's with
-    # `getent group docker | cut -d: -f3` and set DOCKER_GROUP_ID to it.
+    # Joins the host's docker group so the unprivileged image can reach root:docker 0660
+    # /var/run/docker.sock. Host-specific — see DOCKER_GROUP_ID in .env.example.
     group_add:
       - "${DOCKER_GROUP_ID:-999}"
     volumes:

docker/self-host/.env.example

@@ -108,6 +108,12 @@ GH_AUTH_TOKEN=
 #AGENT_ENABLED=false
 #HEPHAESTUS_FABRIC_GC_RETENTION_DAYS=30
 #GIT_CHECKOUT_ENABLED=false
+
+# Supplementary group the app joins so the agent sandbox can reach the Docker socket. The image runs
+# unprivileged and the socket is root:docker 0660, so a wrong value fails every sandbox start with
+# "permission denied" — at first review, not at boot. Read your host's id with
+# `getent group docker | cut -d: -f3`; the 999 default is right on many Debian hosts and wrong on others.
+#DOCKER_GROUP_ID=999
 #PRACTICE_REVIEW_FOR_ALL=false
 #SANDBOX_MAX_CONCURRENT=1