Mail engine setup fails with "open /var/lib/openship/mail/db.env: permission denied" when running as non-root user

[chbndrhnns]

Problem

When setting up the built-in mail engine on a system where Openship runs under a non-root user account that has Docker permissions (e.g. ubuntu in the docker group), mail setup fails during the postgres sidecar deployment:

Deploying the mail engine container...
Starting the mail database (postgres sidecar)...
docker: --env-file: open /var/lib/openship/mail/db.env: permission denied

Run 'docker run --help' for more information
Mail engine setup failed: the mail database container failed to become ready
Mail engine logs:
Error response from daemon: No such container: openship-mail

Root Cause

1. ensureContainerMail uses hostState (elevated/root executor) to write configuration files (/var/lib/openship/mail/db.env and engine.env) and executes chmod 600 on them. Consequently, they are owned by root:root with -rw------- permissions.
2. Next, startDb calls executor.streamExec(buildDbRunCommand(container), onLog) using the standard unprivileged user session (executor).
3. The Docker CLI (docker run ... --env-file /var/lib/openship/mail/db.env ...) parses and reads the --env-file client-side on the host before making the API request to the Docker socket. Because the CLI runs as the unprivileged user, it cannot open db.env (mode 0600 root), resulting in permission denied.
4. As a result, the database sidecar fails to become ready, setup aborts, and the cleanup/error handler fails to retrieve mail engine logs because openship-mail was never created.

Affected Areas

• writeEnvFile / ensureContainerMail in packages/adapters/src/system/mail/ensure-container-mail.ts
• buildDbRunCommand / buildMailRunCommand passing --env-file /var/lib/openship/mail/*.env

Suggested Fix

• Ensure db.env and engine.env are readable by the user/group executing the Docker commands (e.g., set ownership to the executing user or grant appropriate group read permissions when creating the env files).
• Alternatively, adjust writeEnvFile to set permissions or ownership matching the active executor user.

[Hydralerne]

fixed ty