More work

Author: justinlittman

Dockerfile

@@ -20,7 +20,7 @@ WORKDIR /rails
 
 # Install base packages
 RUN apt-get update -qq && \
-    apt-get install --no-install-recommends -y curl libjemalloc2 libvips libpq5 && \
+    apt-get install --no-install-recommends -y curl libjemalloc2 libvips postgresql-client && \
     ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \
     rm -rf /var/lib/apt/lists /var/cache/apt/archives
 
@@ -52,10 +52,6 @@ COPY Gemfile Gemfile.lock ./
 
 RUN bundle install && \
     rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
-    # Some gems (e.g. blanks) ship files as mode 600; the app runs as a
-    # different UID at runtime (see config/deploy.qa.yml), so make sure
-    # installed gems are readable regardless of owner.
-    chmod -R a+rX "${BUNDLE_PATH}" && \
     # -j 1 disable parallel compilation to avoid a QEMU bug: https://github.com/rails/bootsnap/issues/495
     bundle exec bootsnap precompile -j 1 --gemfile
 
@@ -79,20 +75,16 @@ RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
 # Final stage for app image
 FROM base
 
-# Run and own only the runtime files as a non-root user for security
-RUN groupadd --system --gid 1000 rails && \
-    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash
-USER 1000:1000
+# Run and own only the runtime files as a non-root user for security. Matches
+# lyberadmin's uid:gid on the Puppet-managed deploy hosts (see config/deploy.qa.yml)
+# so no runtime --user override is needed there.
+RUN groupadd --system --gid 503 lyberadmin && \
+    useradd lyberadmin --uid 503 --gid 503 --create-home --shell /bin/bash
+USER 503:503
 
 # Copy built artifacts: gems, application
-COPY --chown=rails:rails --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
-COPY --chown=rails:rails --from=build /rails /rails
-
-# Rails creates tmp/{cache,pids,sockets} at boot and writes log/production.log;
-# some destinations (see config/deploy.qa.yml) run the container as a different
-# UID than the image's baked-in rails user, so make these writable regardless
-# of runtime UID.
-RUN chmod -R a+rwX tmp log
+COPY --chown=lyberadmin:lyberadmin --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
+COPY --chown=lyberadmin:lyberadmin --from=build /rails /rails
 
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]

config/deploy.qa.yml

@@ -21,9 +21,6 @@ servers:
       - argo-b3-qa-a.stanford.edu
     options:
       add-host: "host.docker.internal:host-gateway"
-      # Overrides the image's baked-in rails (1000:1000) user so bind-mounted
-      # writes (bulk actions, logs) land as lyberadmin, matching host ownership.
-      user: "503:503"
   # Runs SolidQueue standalone (bin/jobs) rather than in-Puma, so it registers
   # its own graceful-shutdown signal handlers (see solid_queue/supervisor/signals.rb)
   # and can drain in-flight jobs on its own timeline, independent of the web
@@ -35,7 +32,6 @@ servers:
     stop_timeout: <%= ENV.fetch("SOLID_QUEUE_SHUTDOWN_TIMEOUT", 86400) %>
     options:
       add-host: "host.docker.internal:host-gateway"
-      user: "503:503"
 
 ssh:
   user: lyberadmin

config/deploy.yml

@@ -21,6 +21,11 @@ logging:
     max-size: "100m"
     max-file: "5"
 
+aliases:
+  console: app exec --interactive --reuse "bin/rails console -e p"
+  db: app exec --interactive --reuse "bin/rails db -e p"
+  shell: app exec --interactive --reuse "bash"
+
 # Destination-specific configuration (servers, env, secrets, volumes) lives in
 # config/deploy.<destination>.yml, e.g. config/deploy.qa.yml. Run with:
 #   bin/kamal deploy -d qa