Report init.sh setup failures and fix golangci-lint flags in readme - #51
Merged
Conversation
Previously, the timezone setup, the APP_UID substitutions in /etc/passwd and /etc/group, and the chown of /srv and /home/app ran unchecked, so a missing zone file, a read-only /etc or a read-only mount left the container running with the wrong timezone, uid or ownership and nothing in the log pointed at it. After this change every one of those steps is checked and reports what failed and what the container falls back to, and the "set timezone" line is printed only when both halves of the timezone setup succeeded. The APP_UID substitutions are additionally verified against the resulting user and group, since sed exits 0 when the pattern is not found, which happens in a derived image whose app entries no longer use 1001. The messages are printed even with INIT_QUIET=1, since they are not informational. Startup behaviour is unchanged: every step is still attempted, none of these failures stop the container, and the only exits remain the pre-existing ones for docker group setup and for a failing /srv/init.sh.
The image bundles golangci-lint v2, which dropped --out-format, so both documented multi-stage Dockerfiles fail at the lint step with "unknown flag: --out-format". Use the v2 equivalent, --output.tab.path=stdout.
paskal
force-pushed
the
init-diagnostics-and-readme-lint
branch
from
August 20, 2026 07:06
4228a49 to
6472928
Compare
umputun
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent fixes.
init.sh reports failed setup steps. The timezone setup, the
APP_UIDsubstitutions in/etc/passwdand/etc/group, and the chown of/srvand/home/appall ran unchecked, so an invalidTIME_ZONE, a read-only/etc, or a read-only mount under/home/appleft the container running with the wrong timezone, uid or ownership without anything in the log pointing at it. Each of those steps is now checked and reports what failed and what the container falls back to, and theset timezoneline is printed only when both halves of the timezone setup succeeded. TheAPP_UIDsubstitutions are additionally verified against the resulting user and group, becausesedexits 0 when its pattern is not found, which is what happens in a derived image whoseappentries no longer use 1001. Error messages are printed even withINIT_QUIET=1, since they are not informational.Startup behaviour is deliberately unchanged: every step is still attempted, none of these failures stop the container, and the only exits remain the pre-existing ones for docker group setup and for a failing
/srv/init.sh.Checked against locally built images: default run,
TIME_ZONE=Nope/Nope,/etc/localtimeand/etc/timezoneeach mounted read-only in turn,APP_UID=2000,DOCKER_GIDboth free and colliding with thepinggroup,SKIP_HOME_CHOWN=1, a read-only mount under/home/app,INIT_QUIET=1with and without a failure,/srv/init.shboth succeeding and failing, and three derived images whoseappentries the substitutions cannot match: uid 1500 in/etc/passwd, gid 1600 in/etc/group, and uid 2000 with primary gid 1700. Every failing case names the step that failed and still starts the command under theappuser, apart from the failing/srv/init.sh, which keeps exiting 1 as before.Readme lint command. The build image bundles golangci-lint v2, which dropped
--out-format, so both documented multi-stage Dockerfiles fail at the lint step withunknown flag: --out-format. Both examples now use the v2 form,--output.tab.path=stdout, checked inside the publishedbuildgoimage.