Repository navigation
ci: Reach the database without su in the integration tests - #385
Merged
Merged
Conversation
getlago/lago:latest is now the Wolfi image (getlago/lago#852). It runs as uid 65532 and its su is busybox without setuid, so `su postgres` fails with "must be suid to work properly". psql reaches the embedded cluster through its socket in /tmp as the postgres role, which trusts local connections.
vincent-pochet
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The
integration-testsjob startsgetlago/lago:latestand runssu postgres -c "psql -d lago"to set the API key. Since the v1.57.0 release,latestis the Wolfi image from getlago/lago#852: it runs as uid 65532, has nopostgresOS user, and itssuis busybox without setuid. The step now fails withsu: must be suid to work properly, which turnedmainred on the v1.57.0 bump (run) and blocks the Ruby client release.Description
psql -h /tmp -U postgres -d lagodirectly. The image starts Postgres with its socket in/tmpand trusts local connections for thepostgresrole (docker/runner.shin getlago/lago).Checked by hand on a
getlago/lago:v1.57.0container: the new command connects, the old one fails with the same error as CI.