From a1f53538ce0a521104b3e2cecb3d87bd0eead9aa Mon Sep 17 00:00:00 2001 From: Kaan Yagci Date: Sun, 6 Sep 2026 21:49:32 +0200 Subject: [PATCH 1/2] Match production Keycloak startup in disposable restore checks --- scripts/restore-keycloak-cohort-backups.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/scripts/restore-keycloak-cohort-backups.sh b/scripts/restore-keycloak-cohort-backups.sh index 2239a42..6ee6993 100755 --- a/scripts/restore-keycloak-cohort-backups.sh +++ b/scripts/restore-keycloak-cohort-backups.sh @@ -181,14 +181,15 @@ PY docker run --rm --network none --cap-drop ALL --cap-add CHOWN --cap-add FOWNER --security-opt no-new-privileges:true \ --mount "type=bind,src=${secret_file},dst=/secret" "${postgres_image}" \ sh -euc 'chmod 0400 /secret; chown "$1:0" /secret' sh "${keycloak_uid}" + # Match production start: Quarkus augments its disposable writable image layer. docker run -d --name "${active_keycloak_container}" --network "${active_network}" --network-alias keycloak \ - "${labels[@]}" --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m \ + "${labels[@]}" --tmpfs /tmp:rw,noexec,nosuid,size=256m \ --tmpfs "/opt/keycloak/data:rw,nosuid,size=256m,uid=${keycloak_uid},gid=0,mode=0770" \ --cap-drop ALL --security-opt no-new-privileges:true --entrypoint sh \ --mount "type=bind,src=${secret_file},dst=/run/secrets/postgres-password,readonly" \ -e KC_DB=postgres -e KC_DB_URL=jdbc:postgresql://db:5432/keycloak -e KC_DB_USERNAME=keycloak \ - -e KC_HEALTH_ENABLED=true -e KC_HTTP_ENABLED=true -e KC_HOSTNAME_STRICT=false \ - "${runtime_image}" -euc 'export KC_DB_PASSWORD="$(cat /run/secrets/postgres-password)"; exec /opt/keycloak/bin/kc.sh start-dev' >/dev/null + -e KC_HEALTH_ENABLED=true -e KC_METRICS_ENABLED=true -e KC_HTTP_ENABLED=true -e KC_HOSTNAME_STRICT=false \ + "${runtime_image}" -euc 'export KC_DB_PASSWORD="$(cat /run/secrets/postgres-password)"; exec /opt/keycloak/bin/kc.sh start' >/dev/null ready=0 for _ in $(seq 1 180); do if docker run --rm --network "${active_network}" --read-only --cap-drop ALL --security-opt no-new-privileges:true \ From 02bb5cc2ac3bd5ac36d471da5d0d27ce18af30e3 Mon Sep 17 00:00:00 2001 From: Kaan Yagci Date: Sun, 6 Sep 2026 21:52:45 +0200 Subject: [PATCH 2/2] Align the restore validator with production Keycloak startup --- scripts/validate-postgres-config.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/validate-postgres-config.sh b/scripts/validate-postgres-config.sh index 2f77696..b89a294 100755 --- a/scripts/validate-postgres-config.sh +++ b/scripts/validate-postgres-config.sh @@ -879,7 +879,7 @@ for slug, database in ( for required in ("pg_dump", "--no-owner", "--no-privileges", "pg_restore --list", "postgres-postgres-1"): require(required in cohort_capture, f"Live cohort capture is missing: {required}") for required in ( - "pg_restore", "start-dev", "/health/ready", "realm_smtp_config", + "pg_restore", "kc.sh start", "/health/ready", "realm_smtp_config", "authentication_execution", "role_attribute", "composite_role", "client_scope_role_mapping", "protocol_mapper_config", "identity_provider_config", "component_config", "required_action_provider", "configuration_regression", "catwlk-custom-provider", "POSTGRES_PASSWORD_FILE=/run/secrets/postgres-password",