fix(rabbitmq): remove build-time Erlang cookie

.github/workflows/ci.yml

@@ -332,7 +332,13 @@ jobs:
             9.0.x
             10.0.x
       - name: Start RabbitMQ with the delayed-message plugin
-        run: docker compose -f docker-compose-rmq-native-delay.yaml up --build -d --wait
+        run: docker compose -f docker-compose-rmq-native-delay.yaml up --build -d --wait --wait-timeout 120
+      - name: Verify unprivileged broker startup
+        run: |
+          docker compose -f docker-compose-rmq-native-delay.yaml exec -T rabbitmq-native-delay sh -ec '
+            test "$(id -un)" = rabbitmq
+            rabbitmq-diagnostics -q check_running
+          '
       - name: Native delay transport tests
         run: |
           dotnet test tests/Paramore.Brighter.RMQ.Async.Tests/Paramore.Brighter.RMQ.Async.Tests.csproj --filter "Category=RMQNativeDelay" --configuration Release --logger "console;verbosity=normal" --logger GitHubActions

docker-compose-rmq-native-delay.yaml

@@ -3,6 +3,7 @@ services:
     build:
       context: ./docker/RabbitMQ
     image: brighter-4388-rabbitmq-native:local
+    user: rabbitmq
     ports:
       - "127.0.0.1:5673:5672"
     environment:

docker/RabbitMQ/Dockerfile

@@ -8,11 +8,13 @@ FROM rabbitmq:4.2.6-management
 ARG DELAYED_PLUGIN_VERSION=4.2.0-rc.1
 ARG DELAYED_PLUGIN_SHA256=cdd6b59c3cac917ff51d81c62f968903efd62a41686dd3fd792dc0d5df453688
 
+# Discard any cookie generated by root during plugin setup so the runtime user creates its own.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends curl \
  && curl -fsSL -o "$RABBITMQ_HOME/plugins/rabbitmq_delayed_message_exchange-${DELAYED_PLUGIN_VERSION}.ez" \
       "https://github.com/rabbitmq/rabbitmq-delayed-message-exchange/releases/download/v${DELAYED_PLUGIN_VERSION}/rabbitmq_delayed_message_exchange-${DELAYED_PLUGIN_VERSION}.ez" \
  && echo "${DELAYED_PLUGIN_SHA256}  $RABBITMQ_HOME/plugins/rabbitmq_delayed_message_exchange-${DELAYED_PLUGIN_VERSION}.ez" | sha256sum -c - \
  && rabbitmq-plugins enable --offline rabbitmq_delayed_message_exchange rabbitmq_consistent_hash_exchange \
+ && rm -f /var/lib/rabbitmq/.erlang.cookie \
  && apt-get purge -y --auto-remove curl \
  && rm -rf /var/lib/apt/lists/*

docker/RabbitMQ/README.md

@@ -20,6 +20,16 @@ The compose fixture disables Khepri on first boot because the plugin has a
 with Khepri. Use a fresh test volume when changing this setting. The upstream plugin is archived;
 this fixture does not establish compatibility with RabbitMQ 4.3+.
 
+The image removes any Erlang cookie generated during plugin setup. RabbitMQ creates its cookie
+at first startup, owned by the runtime user, so a build-time root-owned cookie cannot prevent
+startup as `rabbitmq`. This applies to fresh containers; it does not repair cookies in existing volumes.
+The Compose fixture starts directly as `rabbitmq`, and CI checks that user and broker health before
+running the native-delay tests. Startup cannot rely on a root entrypoint repairing cookie ownership.
+
+If pulling `rabbitmq:4.2.6-management` fails with `unable to retrieve auth token: invalid username/password`,
+refresh the saved Docker Hub credentials for your container engine, then retry the pull and Compose build.
+This is a registry authentication failure, separate from the broker's cookie permissions.
+
 With `Exchange.SupportDelay = true`, delayed retries publish to `<exchange-name>.requeue`, an
 `x-delayed-message` exchange with `x-delayed-type=direct`, the original exchange's durability,
 and `autoDelete=false`. Each consumer queue binds with its own queue name as the routing key.