Repository navigation
build-pg-focal: build unprivileged so RUN_TESTS=1 can run initdb - #1243
Merged
Kemal Büyükkaya (kemalbuyukkaya) merged 1 commit intoOct 11, 2026
Merged
Kemal Büyükkaya (kemalbuyukkaya) merged 1 commit into
Kemal Büyükkaya (kemalbuyukkaya) merged 1 commit into
Conversation
The builder container runs as root, and dpkg-buildpackage ran as root too.
initdb refuses to run as root, so with RUN_TESTS=1 every major's
check-world bailed out at its first initdb ("initdb: error: cannot be run
as root"), failing the build before signing.
Keep root for apt / mk-build-deps, then hand the tree to an unprivileged
"builder" user and run dpkg-buildpackage through runuser; it gains root
via fakeroot only to assemble the .debs, as Debian intends. Do this with
or without tests so a tested build exercises the same path an untested
one ships.
Validated locally (podman, PG16, RUN_TESTS=1): check-world passes and the
produced package set is identical to the last CI build, with root:root
ownership inside the .debs.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
The focused change addresses the root-only test failure while preserving the existing packaging and artifact workflow.
0 open findings
What changed in this PR
Updates the focal PostgreSQL builder so regression tests can run initdb without root privileges.
Changes:
- Creates or selects an unprivileged build user.
- Transfers work-directory ownership and runs
dpkg-buildpackageviarunuser. - Preserves root access for dependency installation and artifact collection.
| File | Description |
|---|---|
scripts/build_pg_focal |
Runs package compilation and tests as an unprivileged user with fakeroot packaging. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Kemal Büyükkaya (kemalbuyukkaya)
requested a review
from Murat Tuncer (mtuncer)
October 9, 2026 14:13
Murat Tuncer (mtuncer)
approved these changes
Oct 11, 2026
Kemal Büyükkaya (kemalbuyukkaya)
merged commit Oct 11, 2026
0ed7ac5
into
develop
108 of 109 checks passed
Kemal Büyükkaya (kemalbuyukkaya)
deleted the
users/kbuyukkaya/fix-pg-focal-tests-as-root
branch
October 11, 2026 09:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Dispatching Build PostgreSQL core (focal) with
run_tests=1fails for every major (run 37929345256):The builder container runs as root, and
dpkg-buildpackageran as root too.initdbrefuses root, socheck-world(PG14–16:src/test/postmaster; PG13:src/test/regress) bailed out at the firstinitdb. The job stopped before signing.Fix
scripts/build_pg_focalkeeps root only forapt/mk-build-deps. Before[6/6]it:builderuser (override withBUILD_USER),chowns${WORK}to it,dpkg-buildpackagethroughrunuser.When the build isn't run as root,
dpkg-buildpackageusesfakerootautomatically to package the files, as Debian intends. The.debcontents stayroot:root.This applies with or without tests, so a tested build exercises the same path an untested one ships.
Validation
Ran locally with podman, using the image built from
dockerfiles/focal-pg-builderandRUN_TESTS=1:.debcontents are owned byroot:root.