fix: seed nonroot-owned data dir in release Docker image

[leonid-shevtsov]

What & why

Release image (Dockerfile.goreleaser) declared VOLUME /var/lib/mailtrap-local but never created that directory owned by distroless nonroot (UID 65532). Empty anonymous/named volumes then mounted as root:root, so the process could not create db.sqlite3 (unable to open database file (14)). --tmpfs worked because it is world-writable.

Fix: alpine stage seeds an empty dir; COPY --chown=nonroot:nonroot into the image (same pattern as the source-build Dockerfile). Ownership comes from --chown only — no redundant RUN chown.

CI: the docker job now also builds Dockerfile.goreleaser (reuses the binary from the source image) and boots it on the default CMD, so this class of VOLUME/ownership regression cannot slip past again.

Local smoke (linux/arm64 binary + docker build -f Dockerfile.goreleaser):

• Broken (pre-fix): -v /var/lib/mailtrap-local → open store / unable to open database file (14)
• Fixed: anonymous -v /var/lib/mailtrap-local → SMTP + HTTP listening; wrote secret.key + db.sqlite3
• Fixed: named volume → same; volume root owned 65532:65532

How to test

• docker run --rm -p 3535:3535 -p 3550:3550 -v /var/lib/mailtrap-local mailtrap/mailtrap-local:<this-build> starts without DB errors; UI at http://127.0.0.1:3550
• Same with -v mailtrap-local:/var/lib/mailtrap-local (fresh named volume); no manual chown
• CI docker job green (source Dockerfile + goreleaser image boots)

[coderabbitai]

📝 Walkthrough

Walkthrough

The release Dockerfile adds an Alpine preparation stage that seeds /var/lib/mailtrap-local and assigns ownership to UID/GID 65532. The final distroless image copies the prepared directory and binary with nonroot ownership.

Changes

Release image filesystem setup

Layer / File(s)	Summary
Seed and ownership setup Dockerfile.goreleaser	An Alpine stage creates /data-empty, assigns it to the nonroot UID/GID, and the final image copies it into /var/lib/mailtrap-local alongside the binary.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• mailtrap/mailtrap-local#3: Also updates Dockerfile.goreleaser around the persisted data directory and its use for encryption state.

Suggested reviewers: sergeykorolev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: seeding the nonroot-owned data directory in the release Docker image.
Description check	✅ Passed	The description covers motivation, changes, and testing, with only a non-critical Images and GIFs section missing.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}