26653303499
95%

Ran 29 May 2026 06:01PM UTC

Jobs 1

Files 92

Run time 1min

Badge

Embed ▾

Committed 29 May 2026 05:54PM UTC coverage: 94.848%. Remained the same

Build # 26653303499

Build Type

push

github

Committed by

web-flow

Commit Message

fix(deploy): pre-create DATA_DIR owned by non-root user in image (#576)

The runtime image creates the tsoracle user (uid 10001) but never creates
/data, the path entrypoint.sh defaults DATA_DIR to. As a result the file
driver could not start under a plain `docker run`:

  - with no volume, uid 10001 cannot mkdir /data at the filesystem root;
  - with a fresh named volume mounted at /data, Docker seeds the mountpoint
    root-owned, so the server hits "failed to open storage at /data: io:
    Permission denied (os error 13)".

Kubernetes sidesteps this via the chart's podSecurityContext.fsGroup, which
re-owns the PVC, so the bug only surfaces on the standalone Docker path.

Pre-create /data in the image owned by tsoracle. A fresh named volume now
inherits that ownership when Docker seeds it, and the no-volume case has a
writable dir. Kubernetes is unaffected: fsGroup still applies on top
(fsGroupChangePolicy: OnRootMismatch skips the redundant re-chown).

Signed-off-by: Sebastian Thiebaud <sebastian@prismarisk.com>

Coverage Stats

14195 of 14966 relevant lines covered (94.85%)

354118.18 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	26653303499.1	29 May 2026 06:01PM UTC	92	94.85	GitHub Action Run

prisma-risk / tsoracle / 26653303499
95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26653303499

prisma-risk / tsoracle / 26653303499 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26653303499

prisma-risk / tsoracle / 26653303499
95%

README BADGES
x