From cd6ef14d005c5b55af02c2c67bed7b0bd1261d64 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 22 Oct 2025 14:28:44 -0700
Subject: [PATCH] beamer-testbed runs with local user's UID/GID

so that created files aren't owned by root
---
 Dockerfile                        | 6 +-----
 Dockerfile.dev                    | 5 +++--
 Procfile.beamer-testbed           | 2 +-
 bin/beamer-testbed                | 4 ++++
 docker-compose.beamer-testbed.yml | 1 +
 5 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 3e21f7f38..b9656b31c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -61,11 +61,7 @@ RUN apt-get update -qq && \
 COPY --from=build /usr/local/bundle /usr/local/bundle
 COPY --from=build /rails /rails
 COPY --from=beamer /home/beamer/bin/beamer.so /rails/bin/lib/beamer.so
-
-# Run and own only the runtime files as a non-root user for security
-RUN useradd rails --create-home --shell /bin/bash && \
-    chown -R rails:rails db log storage tmp
-USER rails:rails
+COPY --from=beamer /usr/local/bin/beamer /rails/bin/beamer
 
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]
diff --git a/Dockerfile.dev b/Dockerfile.dev
index 8ec772ce1..38d461b2d 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -21,7 +21,7 @@ COPY Gemfile Gemfile.lock .ruby-version ./
 COPY lib/bootstrap.rb ./lib/bootstrap.rb
 COPY gems ./gems/
 RUN --mount=type=secret,id=GITHUB_TOKEN --mount=type=cache,id=fizzy-devbundle-${RUBY_VERSION},sharing=locked,target=/devbundle \
-    gem install bundler && \
+    gem install bundler foreman && \
     BUNDLE_PATH=/devbundle BUNDLE_GITHUB__COM="$(cat /run/secrets/GITHUB_TOKEN):x-oauth-basic" bundle install && \
     cp -a /devbundle/. "$BUNDLE_PATH"/ && \
     bundle clean --force
@@ -32,7 +32,8 @@ FROM registry.37signals.com/basecamp/beamer:vfs AS beamer
 # Final stage
 FROM base
 
-# Copy beamer
+# Copy beamer into /usr/local because /rails is mounted as a volume and will overwrite anything
+# there.
 COPY --from=beamer /home/beamer/bin/beamer.so /usr/local/lib/beamer/beamer.so
 COPY --from=beamer /usr/local/bin/beamer /usr/local/bin/beamer
 
diff --git a/Procfile.beamer-testbed b/Procfile.beamer-testbed
index e24b485ff..e6cd59476 100644
--- a/Procfile.beamer-testbed
+++ b/Procfile.beamer-testbed
@@ -1,3 +1,3 @@
 web: bin/thrust bin/rails server
 beamer: beamer --debug --directory ./storage/ run --primary ${BEAMER_PRIMARY:-$(hostname)}
-migrations: ./bin/beamer-testbed run-migrations --debug --directory ./storage/
+migrations: bin/beamer-testbed run-migrations --debug --directory ./storage/
diff --git a/bin/beamer-testbed b/bin/beamer-testbed
index 401f1720d..f4030dbb9 100755
--- a/bin/beamer-testbed
+++ b/bin/beamer-testbed
@@ -84,6 +84,10 @@ cmd_start() {
   local fizzy_services=$(get_fizzy_services)
   local first_fizzy=$(echo "$fizzy_services" | head -n 1)
 
+  # Set UID and GID for Docker user mapping
+  export DOCKER_UID=$(id -u)
+  export DOCKER_GID=$(id -g)
+
   # Get GitHub token from gh CLI
   echo "Getting GitHub token from gh CLI..."
   export GITHUB_TOKEN=$(gh auth token)
diff --git a/docker-compose.beamer-testbed.yml b/docker-compose.beamer-testbed.yml
index 5b034c64c..0cbbffab2 100644
--- a/docker-compose.beamer-testbed.yml
+++ b/docker-compose.beamer-testbed.yml
@@ -1,5 +1,6 @@
 x-app: &app
   image: "basecamp/fizzy:dev"
+  user: "${DOCKER_UID:-1000}:${DOCKER_GID:-1000}"
   build:
     context: .
     dockerfile: Dockerfile.dev