fix: seed nonroot-owned data dir in release Docker image

[leonid-shevtsov]

What & why

Release image (Dockerfile.goreleaser) declared VOLUME /var/lib/mailtrap-local but never created that directory owned by distroless nonroot (UID 65532). Empty anonymous/named volumes then mounted as root:root, so the process could not create db.sqlite3 (unable to open database file (14)). --tmpfs worked because it is world-writable.

Fix: alpine stage seeds an empty dir; COPY --chown=nonroot:nonroot into the image (same pattern as the source-build Dockerfile).

Local smoke (linux/arm64 binary + docker build -f Dockerfile.goreleaser):

• Broken (pre-fix): -v /var/lib/mailtrap-local → open store / unable to open database file (14)
• Fixed: anonymous -v /var/lib/mailtrap-local → SMTP + HTTP listening; wrote secret.key + db.sqlite3
• Fixed: named volume → same; volume root owned 65532:65532

How to test

• docker run --rm -p 3535:3535 -p 3550:3550 -v /var/lib/mailtrap-local mailtrap/mailtrap-local:<this-build> starts without DB errors; UI at http://127.0.0.1:3550
• Same with -v mailtrap-local:/var/lib/mailtrap-local (fresh named volume); no manual chown

Summary by CodeRabbit

• Bug Fixes
  • Improved container setup for persisted data by ensuring the data directory exists with the correct permissions.
  • Enhanced compatibility with the non-root runtime environment in the packaged image.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 39ca7cf1-fcb1-47a7-9719-4abf5d2d4cf5

📥 Commits

Reviewing files that changed from the base of the PR and between 70199ce and 0af80d8.

📒 Files selected for processing (1)

• Dockerfile.goreleaser

---

📝 Walkthrough

Walkthrough

The release Dockerfile adds an Alpine preparation stage that seeds /var/lib/mailtrap-local and assigns ownership to UID/GID 65532. The final distroless image copies the prepared directory and binary with nonroot ownership.

Changes

Release image filesystem setup

Layer / File(s)	Summary
Seed and ownership setup Dockerfile.goreleaser	An Alpine stage creates /data-empty, assigns it to the nonroot UID/GID, and the final image copies it into /var/lib/mailtrap-local alongside the binary.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mailtrap/mailtrap-local#3: Also updates Dockerfile.goreleaser around the persisted data directory and its use for encryption state.

Suggested reviewers: sergeykorolev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: seeding a nonroot-owned data directory in the release Docker image.
Description check	✅ Passed	The description covers motivation and testing, but it does not follow the repository template headings for Changes or Images/GIFs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}