From 0fb55f3ae8976431f0b2112ce0113d4a7bedf903 Mon Sep 17 00:00:00 2001
From: Trenton H <797416+stumpylog@users.noreply.github.com>
Date: Wed, 9 Apr 2025 14:15:38 -0700
Subject: [PATCH] Fix: Run migration lock as the correct user (#9604)

---
 .../s6-rc.d/init-migrations/migrate.sh        |  7 ++++++
 .../s6-overlay/s6-rc.d/init-migrations/run    | 22 ++++++-------------
 2 files changed, 14 insertions(+), 15 deletions(-)
 create mode 100755 docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh

diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh
new file mode 100755
index 000000000..93b45fd06
--- /dev/null
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh
@@ -0,0 +1,7 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+declare -r data_dir="${PAPERLESS_DATA_DIR:-/usr/src/paperless/data}"
+
+# shellcheck disable=SC2164
+cd "${PAPERLESS_SRC_DIR}"
+exec s6-setlock -n "${data_dir}/migration_lock" python3 manage.py migrate --skip-checks --no-input
diff --git a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/run b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/run
index db0dc26d3..777724886 100755
--- a/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/run
+++ b/docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/run
@@ -1,20 +1,12 @@
 #!/command/with-contenv /usr/bin/bash
 # shellcheck shell=bash
 declare -r log_prefix="[init-migrations]"
-declare -r data_dir="${PAPERLESS_DATA_DIR:-/usr/src/paperless/data}"
 
-(
-	# flock is in place to prevent multiple containers from doing migrations
-	# simultaneously. This also ensures that the db is ready when the command
-	# of the current container starts.
-	flock 200
-	echo "${log_prefix} Apply database migrations..."
-	cd "${PAPERLESS_SRC_DIR}"
+echo "${log_prefix} Apply database migrations..."
 
-	if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-		exec python3 manage.py migrate --skip-checks --no-input
-	else
-		exec s6-setuidgid paperless python3 manage.py migrate --skip-checks --no-input
-	fi
-
-) 200>"${data_dir}/migration_lock"
+# The whole migrate, with flock, needs to run as the right user
+if [[ -n "${USER_IS_NON_ROOT}" ]]; then
+	exec /etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh
+else
+	exec s6-setuidgid paperless /etc/s6-overlay/s6-rc.d/init-migrations/migrate.sh
+fi