Root cause: a 'keys' Docker volume created by an older root-running image is owned
by root, but the container now runs as the non-root 'app' user (uid 1654). The API
can't read/write its DataProtection key ring, so encrypting the OAuth correlation
cookie fails and /api/v1/auth/login returns 500. (Staging was unaffected only because
its volumes were recreated fresh during the pgvector swap.)
Fixes:
- compose: a one-shot 'init-keys' service (root busybox) chowns the keys volume to
1654:1654 before the api starts (depends_on service_completed_successfully). Auto-heals
any pre-existing root-owned volume — local, staging, and future deployments.
- Dockerfile: install libgssapi-krb5-2 — the slim aspnet:10.0 image dropped it and
Npgsql logged 'Cannot load library libgssapi_krb5.so.2' on every connection.
Verified on a clean local stack: 0 key-ring errors, 0 krb5 errors, login now 302.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cesnimda