Repository navigation
Custom-distribution image (arcadedb-builder.sh) runs as system UID 100:101, volumes not interchangeable with the official images #10330
Description
Follow-up of #10319.
Gap
#10319 aligns the JVM image (package/src/main/docker/Dockerfile, now adduser -D -u 1000) and both native images (Dockerfile.native.scratch, Dockerfile.native.distroless) on UID/GID 1000:1000, so their volumes are interchangeable.
The Dockerfile that package/arcadedb-builder.sh generates for a custom distribution (heredoc in generate_dockerfile()) still creates a system user:
RUN addgroup -S ${ARCADEDB_USER} && adduser -S ${ARCADEDB_USER} -G ${ARCADEDB_USER}
On eclipse-temurin:25-jre-alpine that resolves to uid=100(arcadedb) gid=101(arcadedb) (verified with docker run --rm eclipse-temurin:25-jre-alpine sh -c 'addgroup -S arcadedb && adduser -S arcadedb -G arcadedb && id arcadedb'). A volume written by a custom-built image therefore cannot be opened by the official images (and vice versa) without a chown, and the security files are mode 600.
Why it was left out of #10319
Changing it changes the owner of existing custom-image deployments' volumes (one-time chown -R 1000:1000 needed, release note), and the issue's decision covered the JVM, amd64-native and arm64-native images only.
Proposed fix
addgroup -g 1000 -S ... / adduser -S -u 1000 ... (or drop -S and pin -u 1000 like the main Dockerfile), and extend PackagingManifestsTest.jvmImageRunsAsTheUidTheNativeImagesShare to cover the generated Dockerfile (jvmDockerfiles() already returns it).
Activity
fix(#10330): custom-distribution image runs as 1000:1000 like the off…
robfrank commentedon Oct 19, 2026
Fixed in #10351. The Dockerfile that
package/arcadedb-builder.shgenerates for a custom distribution created an Alpine system user, which ends up as100:101, while the official JVM and native images run as1000:1000since #10319. So a volume written by one image could not be opened by the other without achown. The generated image now creates its user exactly like the official JVM image (1000:1000), and a packaging test checks both Dockerfiles so they cannot drift apart again.Upgrade note: existing custom-distribution deployments have volumes owned by
100:101. After upgrading, runchown -R 1000:1000once on thedatabases,backupsandlogvolumes. This is also documented inpackage/README-BUILDER.md("Docker image user"). The official images are not affected.Still open: nothing, the fix is complete.
❤️ Thanks for helping make ArcadeDB better! ArcadeDB is free and open source, sustained by its community. If it's useful to you or your company, please consider becoming a sponsor to keep development going.
fix(#10330): custom-distribution image runs as 1000:1000 like the off…