From 2919d5e9e6b5dd9d18739af4f1ab1a18d2ddfb3b Mon Sep 17 00:00:00 2001
From: gabisonia <irakli.gabisonia94@gmail.com>
Date: Fri, 9 Oct 2026 20:54:02 +0200
Subject: [PATCH] fix(rabbitmq): remove build-time Erlang cookie

---
 .github/workflows/ci.yml             |  8 +++++++-
 docker-compose-rmq-native-delay.yaml |  1 +
 docker/RabbitMQ/Dockerfile           |  2 ++
 docker/RabbitMQ/README.md            | 10 ++++++++++
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 054b088165..ea88c4494a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -332,7 +332,13 @@ jobs:
             9.0.x
             10.0.x
       - name: Start RabbitMQ with the delayed-message plugin
-        run: docker compose -f docker-compose-rmq-native-delay.yaml up --build -d --wait
+        run: docker compose -f docker-compose-rmq-native-delay.yaml up --build -d --wait --wait-timeout 120
+      - name: Verify unprivileged broker startup
+        run: |
+          docker compose -f docker-compose-rmq-native-delay.yaml exec -T rabbitmq-native-delay sh -ec '
+            test "$(id -un)" = rabbitmq
+            rabbitmq-diagnostics -q check_running
+          '
       - name: Native delay transport tests
         run: |
           dotnet test tests/Paramore.Brighter.RMQ.Async.Tests/Paramore.Brighter.RMQ.Async.Tests.csproj --filter "Category=RMQNativeDelay" --configuration Release --logger "console;verbosity=normal" --logger GitHubActions
diff --git a/docker-compose-rmq-native-delay.yaml b/docker-compose-rmq-native-delay.yaml
index 9f44b0b2be..6788478b69 100644
--- a/docker-compose-rmq-native-delay.yaml
+++ b/docker-compose-rmq-native-delay.yaml
@@ -3,6 +3,7 @@ services:
     build:
       context: ./docker/RabbitMQ
     image: brighter-4388-rabbitmq-native:local
+    user: rabbitmq
     ports:
       - "127.0.0.1:5673:5672"
     environment:
diff --git a/docker/RabbitMQ/Dockerfile b/docker/RabbitMQ/Dockerfile
index 634ef4b3b4..a40d098413 100644
--- a/docker/RabbitMQ/Dockerfile
+++ b/docker/RabbitMQ/Dockerfile
@@ -8,11 +8,13 @@ FROM rabbitmq:4.2.6-management
 ARG DELAYED_PLUGIN_VERSION=4.2.0-rc.1
 ARG DELAYED_PLUGIN_SHA256=cdd6b59c3cac917ff51d81c62f968903efd62a41686dd3fd792dc0d5df453688
 
+# Discard any cookie generated by root during plugin setup so the runtime user creates its own.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends curl \
  && curl -fsSL -o "$RABBITMQ_HOME/plugins/rabbitmq_delayed_message_exchange-${DELAYED_PLUGIN_VERSION}.ez" \
       "https://github.com/rabbitmq/rabbitmq-delayed-message-exchange/releases/download/v${DELAYED_PLUGIN_VERSION}/rabbitmq_delayed_message_exchange-${DELAYED_PLUGIN_VERSION}.ez" \
  && echo "${DELAYED_PLUGIN_SHA256}  $RABBITMQ_HOME/plugins/rabbitmq_delayed_message_exchange-${DELAYED_PLUGIN_VERSION}.ez" | sha256sum -c - \
  && rabbitmq-plugins enable --offline rabbitmq_delayed_message_exchange rabbitmq_consistent_hash_exchange \
+ && rm -f /var/lib/rabbitmq/.erlang.cookie \
  && apt-get purge -y --auto-remove curl \
  && rm -rf /var/lib/apt/lists/*
diff --git a/docker/RabbitMQ/README.md b/docker/RabbitMQ/README.md
index 653c11cd11..7fae8d0395 100644
--- a/docker/RabbitMQ/README.md
+++ b/docker/RabbitMQ/README.md
@@ -20,6 +20,16 @@ The compose fixture disables Khepri on first boot because the plugin has a
 with Khepri. Use a fresh test volume when changing this setting. The upstream plugin is archived;
 this fixture does not establish compatibility with RabbitMQ 4.3+.
 
+The image removes any Erlang cookie generated during plugin setup. RabbitMQ creates its cookie
+at first startup, owned by the runtime user, so a build-time root-owned cookie cannot prevent
+startup as `rabbitmq`. This applies to fresh containers; it does not repair cookies in existing volumes.
+The Compose fixture starts directly as `rabbitmq`, and CI checks that user and broker health before
+running the native-delay tests. Startup cannot rely on a root entrypoint repairing cookie ownership.
+
+If pulling `rabbitmq:4.2.6-management` fails with `unable to retrieve auth token: invalid username/password`,
+refresh the saved Docker Hub credentials for your container engine, then retry the pull and Compose build.
+This is a registry authentication failure, separate from the broker's cookie permissions.
+
 With `Exchange.SupportDelay = true`, delayed retries publish to `<exchange-name>.requeue`, an
 `x-delayed-message` exchange with `x-delayed-type=direct`, the original exchange's durability,
 and `autoDelete=false`. Each consumer queue binds with its own queue name as the routing key.