beamer-testbed runs with local user's UID/GID

so that created files aren't owned by root

Dockerfile

@@ -61,11 +61,7 @@ RUN apt-get update -qq && \
 COPY --from=build /usr/local/bundle /usr/local/bundle
 COPY --from=build /rails /rails
 COPY --from=beamer /home/beamer/bin/beamer.so /rails/bin/lib/beamer.so
-
-# Run and own only the runtime files as a non-root user for security
-RUN useradd rails --create-home --shell /bin/bash && \
-    chown -R rails:rails db log storage tmp
-USER rails:rails
+COPY --from=beamer /usr/local/bin/beamer /rails/bin/beamer
 
 # Entrypoint prepares the database.
 ENTRYPOINT ["/rails/bin/docker-entrypoint"]

Dockerfile.dev

@@ -21,7 +21,7 @@ COPY Gemfile Gemfile.lock .ruby-version ./
 COPY lib/bootstrap.rb ./lib/bootstrap.rb
 COPY gems ./gems/
 RUN --mount=type=secret,id=GITHUB_TOKEN --mount=type=cache,id=fizzy-devbundle-${RUBY_VERSION},sharing=locked,target=/devbundle \
-    gem install bundler && \
+    gem install bundler foreman && \
     BUNDLE_PATH=/devbundle BUNDLE_GITHUB__COM="$(cat /run/secrets/GITHUB_TOKEN):x-oauth-basic" bundle install && \
     cp -a /devbundle/. "$BUNDLE_PATH"/ && \
     bundle clean --force
@@ -32,7 +32,8 @@ FROM registry.37signals.com/basecamp/beamer:vfs AS beamer
 # Final stage
 FROM base
 
-# Copy beamer
+# Copy beamer into /usr/local because /rails is mounted as a volume and will overwrite anything
+# there.
 COPY --from=beamer /home/beamer/bin/beamer.so /usr/local/lib/beamer/beamer.so
 COPY --from=beamer /usr/local/bin/beamer /usr/local/bin/beamer
 

Procfile.beamer-testbed

@@ -1,3 +1,3 @@
 web: bin/thrust bin/rails server
 beamer: beamer --debug --directory ./storage/ run --primary ${BEAMER_PRIMARY:-$(hostname)}
-migrations: ./bin/beamer-testbed run-migrations --debug --directory ./storage/
+migrations: bin/beamer-testbed run-migrations --debug --directory ./storage/

bin/beamer-testbed

@@ -84,6 +84,10 @@ cmd_start() {
   local fizzy_services=$(get_fizzy_services)
   local first_fizzy=$(echo "$fizzy_services" | head -n 1)
 
+  # Set UID and GID for Docker user mapping
+  export DOCKER_UID=$(id -u)
+  export DOCKER_GID=$(id -g)
+
   # Get GitHub token from gh CLI
   echo "Getting GitHub token from gh CLI..."
   export GITHUB_TOKEN=$(gh auth token)

docker-compose.beamer-testbed.yml

@@ -1,5 +1,6 @@
 x-app: &app
   image: "basecamp/fizzy:dev"
+  user: "${DOCKER_UID:-1000}:${DOCKER_GID:-1000}"
   build:
     context: .
     dockerfile: Dockerfile.dev