fix(docker): make the git-checkout volume writable by the runtime user

[FelixTJDietrich]

Description

The first practice review ever executed on staging failed like this:

Agent job failed: jobId=140efc9b…, error=Failed to lock CAS blob 0a603c06…
java.io.UncheckedIOException: Failed to lock CAS blob …
    at ContentAddressedStore.lockBlob(ContentAddressedStore.java:245)
Caused by: java.nio.file.AccessDeniedException: /data/git-repos/cas

A named volume is created root-owned, and one created by an earlier image keeps that image's uid. Staging's app_git-repos is owned by 100:101 at mode 0755 while the buildpack image runs as 1002:1001, so the agent cannot create its content-addressed store under the volume.

Nothing writes there until an agent job runs, which is why this never showed up before: the deployment reports healthy, the health indicator is green, and the failure appears only when someone finally enables reviews. The preview stack already carries a volume-init for exactly this reason — the production stack does not.

What changes

A one-shot volume-init that both application roles wait on, matching the preview stack:

find /data/git-repos ! -user 1002 -exec chown -h 1002:1001 {} + && chmod 0755 /data/git-repos

Two deliberate details:

• ! -user 1002 — only entries with the wrong owner are touched, so an already-correct volume costs one metadata walk rather than a recursive rewrite of every deploy. Staging's tree is 6 GB across 216 repositories.
• chown -h — the tree contains dangling symlinks (vendored framework directories with Versions/Current pointing at nothing). Without -h, chown follows them, fails with No such file or directory, and exits non-zero, which would make the init container fail the deploy. Verified on the live volume: it errored without -h, and reported zero remaining wrong-owner entries with it.

How to test

On the affected volume:

$ docker run --rm -v app_git-repos:/data alpine:3 \
    sh -c 'find /data ! -user 1002 -exec chown -h 1002:1001 {} + && chmod 0755 /data'
$ find /var/lib/docker/volumes/app_git-repos/_data ! -user 1002 | wc -l
0

The agent then creates /data/git-repos/cas (drwxr-xr-x 1002 1001) on the next job, and the AccessDeniedException is gone — confirmed on staging, where the following review reached evidence collection instead of failing at sandbox preparation.

Checklist

• My changeset summary reads as an operator/user-facing note (it becomes the changelog entry) — see .changeset/README.md
• If the operator must act on this change (new required env var, manual migration step), the changeset summary says how (**Operators:** …) and MIGRATION.md is updated

No new variable and no operator action — the init runs as part of the stack. MIGRATION.md is untouched.

[coderabbitai]

Warning

Review limit reached

@FelixTJDietrich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 80a5c8ab-de50-440e-a550-0ad8445c7d8a

📥 Commits

Reviewing files that changed from the base of the PR and between dae91e3 and 96ceb24.

📒 Files selected for processing (4)

• .changeset/practice-review-writable-fabric.md
• docker/compose.app.yaml
• docker/preview/compose.app.yaml
• docker/self-host/.env.example

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)