install.sh reads Postgres/SeaweedFS data from raw named volumes, breaking bind-mounted volumes (26.8.0: KEK migration aborts, 26.9.0: trixie REINDEX silently skipped) #4521

Self-Hosted Version

26.8.0 (bug also present in 26.9.0 and master)

CPU Architecture

x86_64

Docker Version

29.6.2

Docker Compose Version

5.3.1

Machine Specification

• My system meets the minimum system requirements of Sentry

Installation Type

Upgrade from 26.7.2 to 26.8.0 (plus review of the 26.9.0 install scripts)

Steps to Reproduce

1. Provide the persistent volumes through docker-compose.override.yml as bind-mounted local volumes (a common setup; the override file is gitignored for exactly this purpose):

   volumes:
     sentry-seaweedfs:
       external: false
       driver: local
       driver_opts: { type: none, o: bind, device: /srv/sentry/data/seaweedfs }
     sentry-postgres:
       external: false
       driver: local
       driver_opts: { type: none, o: bind, device: /srv/sentry/data/postgres }

   Compose then uses the volume sentry-self-hosted_sentry-seaweedfs, while install/create-docker-volumes.sh additionally creates an empty raw volume named sentry-seaweedfs (same for sentry-postgres).
2. Start from a working 26.7.2 installation (weed mini 4.29 has created /data/.mini_kek_passphrase and /data/.mini_sse_kek; the filer holds a wrapped KEK in /etc/s3/sse_kek).
3. git checkout 26.8.0 && ./install.sh --skip-user-creation --no-report-self-hosted-issues --apply-automatic-config-updates
4. For the second occurrence: read install/upgrade-postgres.sh as of 26.9.0 (postgres image changes from 14.23-bookworm to 14.24-trixie).

Expected Result

Install scripts access service data through the compose-resolved volumes (e.g. $dcr --no-deps -T --entrypoint sh seaweedfs -c '...'), never through hard-coded raw volume names, so bind-mounted or renamed volumes behave exactly like the default external named volumes. Everything else in install.sh already works that way ($dc run, $dc exec).

Actual Result

Two scripts use $CONTAINER_ENGINE run --rm -v sentry-<name>:/... busybox|python3 and therefore look at the empty raw volume:

1. install/migrate-seaweedfs-kek.sh (26.8.0, 26.9.0, master) - install aborts. The temporary filer is started with $dc run (real data, finds the wrapped KEK, HTTP 200), but scripts/recover_seaweedfs_kek.py runs with docker run ... -v sentry-seaweedfs:/data:ro, sees an empty /data and fails:

▶ Migrating the SeaweedFS encryption key ...
usage: recover_seaweedfs_kek.py [-h] passphrase_file
recover_seaweedfs_kek.py: error: the SeaweedFS KEK is wrapped but .mini_kek_passphrase is missing or empty
Error in install/migrate-seaweedfs-kek.sh:84.
'recovered_kek=$(printf '%s' "$stored_kek" | $CONTAINER_ENGINE run --rm -i --entrypoint python3 -v ".../scripts/recover_seaweedfs_kek.py:/recover_seaweedfs_kek.py:ro" -v sentry-seaweedfs:/data:ro sentry-self-hosted-local /recover_seaweedfs_kek.py /data/.mini_kek_passphrase)' exited with status 2

Proof: docker volume inspect sentry-seaweedfs -> mountpoint is empty, while docker compose run --rm --no-deps -T --entrypoint sh seaweedfs -c 'ls -la /data' shows .mini_kek_passphrase (64 bytes) and .mini_sse_kek. @saibotk reported the identical trace in the #4461 comments and dismissed it as noise - it is this bug.

2. install/upgrade-postgres.sh (26.9.0) - required REINDEX silently skipped, permanently. postgres_version and needs_reindex are read via docker run -v sentry-postgres:/db busybox, i.e. from the empty raw volume, so needs_reindex is never yes. The script then still runs $dc exec postgres sh -c 'touch "$PGDATA/14-trixie-reindexed"' against the real data directory. Result for every bind-mount user upgrading to 26.9.0: the one-time REINDEX for the glibc 2.36 -> 2.41 change (postgres:14.24-trixie) never happens and can never be triggered again by the script (also the 9.6 detection can never match).

Workarounds used here: (1) run the KEK migration through compose: read the passphrase with $dcr --no-deps -T --entrypoint sh seaweedfs -c 'cat /data/.mini_kek_passphrase', hand it to recover_seaweedfs_kek.py via a bind-mounted temp file, write /data/.mini_sse_kek and the marker with $dcr ... seaweedfs -c 'umask 077; cat > /data/.mini_sse_kek'; then re-run install.sh (migration is skipped, 26.8.0 came up healthy). (2) run REINDEX DATABASE postgres; manually right after the switch to the trixie image.

Suggested fix: replace the raw docker run -v sentry-... calls with $dcr --no-deps -T --entrypoint <cmd> <service> ... (for Postgres e.g. --entrypoint cat postgres /var/lib/postgresql/data/PG_VERSION), and pass the SeaweedFS passphrase into the Python container via stdin or a temp file instead of mounting the volume by name. Alternatively resolve the real volume name from $dc config --format json before using docker run -v.

Event ID

No response