Docker entrypoint fails on non-root runtimes (ECS Fargate, Bottlerocket, etc.)

[goingforstudying-ctrl]

Docker entrypoint fails on non-root runtimes (ECS Fargate, Bottlerocket, etc.)

After the Dockerfile switched to USER vault in 2.0.0, the entrypoint still tries to run setcap and chown unconditionally. On runtimes that don't grant IPC_LOCK or where the container starts as a non-root user, setcap fails with EPERM and the container exits before vault ever runs.

I hit this on an ECS Fargate task — the only workaround was setting SKIP_SETCAP=true, but that still leaves the entrypoint printing confusing warnings and doesn't handle the case where someone explicitly disabled mlock via VAULT_DISABLE_MLOCK.

The fix adds an explicit non-root branch to both entrypoint scripts:

• scripts/docker/docker-entrypoint.sh — used by the main Docker build
• .release/docker/ubi-docker-entrypoint.sh — used by the Red Hat UBI build

What changes:

• When id -u != 0, we skip the setcap/chown block entirely instead of failing
• We still print the SKIP_SETCAP / SKIP_CHOWN warnings so operators know what's happening
• We respect VAULT_DISABLE_MLOCK so users who explicitly disabled mlock don't get spurious errors
• The root path is unchanged: it still runs setcap, chown, and drops to the vault user via su-exec

I also added a small Go test under scripts/docker/ that syntax-checks both entrypoint scripts and verifies the non-root guard is present. It's not a full integration test, but it catches accidental regressions in the shell logic.

Fixes #31919

[vercel]

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `public`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vault-ui	Error		Jul 17, 2026 8:06am