Robusta fork: run entrypoint without sudo under non-root UIDs (OpenShift)

OpenShift's restricted-v2 SCC forces containers to run as a random
non-root UID *and* sets no_new_privs=1, which blocks sudo outright
(even when sudo is only de-escalating from root to nobody). Upstream's
run.sh assumed the container always starts as root and unconditionally
shelled out to `sudo -E -u nobody`, so the pod crashed before migrations
could run.

Wrap the privilege drop in a small helper that checks `id -u`: when
we're already non-root, invoke the binary directly. This keeps the
upstream behavior on platforms that start as root (drop to `nobody`)
while letting OpenShift run unchanged.

Also relax /app permissions to `chgrp 0 + chmod g=u` so the random UID
(which has gid 0 as a supplemental group on OpenShift) can read the
release and write to /app/.pgdelta-cache.

Author: RoiGlinik

Dockerfile

@@ -94,10 +94,15 @@ RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
 
 WORKDIR "/app"
 
-RUN chown nobody /app && mkdir -p /app/.pgdelta-cache && chown nobody /app/.pgdelta-cache
+RUN chown nobody:root /app && chmod g=u /app && \
+    mkdir -p /app/.pgdelta-cache && chown nobody:root /app/.pgdelta-cache && chmod g=u /app/.pgdelta-cache
 
 COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/realtime ./
 COPY run.sh run.sh
+# Robusta fork: make everything under /app group-accessible so OpenShift's
+# arbitrary-UID model (random UID + supplemental gid 0) can read/execute
+# the release and write to pgdelta-cache.
+RUN chgrp -R 0 /app && chmod -R g=u /app
 RUN ls -la /app
 ENTRYPOINT ["/usr/bin/tini", "-s", "-g", "--", "/app/run.sh"]
 CMD ["/app/bin/server"]

run.sh

@@ -94,12 +94,25 @@ if [[ -n "${GENERATE_CLUSTER_CERTS:-}" ]] ; then
     generate_certs
 fi
 
+# Robusta fork: drop to `nobody` via sudo only when the container starts
+# as root. On platforms that already force a non-root UID (notably OpenShift
+# under the restricted-v2 SCC, where no_new_privs blocks sudo entirely),
+# invoke the binary directly — we're already non-root, there's nothing
+# to drop to.
+run_as_nobody() {
+    if [ "$(id -u)" -eq 0 ]; then
+        sudo -E -u nobody "$@"
+    else
+        "$@"
+    fi
+}
+
 echo "Running migrations"
-sudo -E -u nobody /app/bin/migrate
+run_as_nobody /app/bin/migrate
 
 if [ "${SEED_SELF_HOST-}" = true ]; then
     echo "Seeding selfhosted Realtime"
-    sudo -E -u nobody /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)'
+    run_as_nobody /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)'
 fi
 
 echo "Starting Realtime"