@bastani/atomic 0.9.10 → 0.9.11-alpha.10

package/dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts

@@ -0,0 +1,172 @@
+/**
+ * Root-execution support for the embedded DBOS Postgres.
+ *
+ * PostgreSQL categorically refuses to run `initdb`/`postgres` as UID 0, so a
+ * root Atomic process (common in containers, CI sandboxes, and eval harnesses)
+ * cannot provision the embedded cluster directly. On Linux we instead resolve
+ * an unprivileged system account, keep the cluster under a root-safe base
+ * directory (`/root` is mode 0700 and untraversable by that account), and run
+ * every Postgres command with dropped privileges.
+ *
+ * Privilege dropping is strategy-probed at runtime: Node honors the child
+ * process `uid`/`gid` spawn options, but Bun currently ignores them, so we
+ * verify the drop actually happens (`id -u` must report the owner) and fall
+ * back to `setpriv`, `runuser`, or `su` wrappers when it does not.
+ *
+ * The embedded binaries themselves may also live under an untraversable
+ * prefix (for example a root-owned `~/.nvm` global install), so the caller can
+ * probe them as the unprivileged owner and fall back to a one-time copy into
+ * the cluster base directory.
+ */
+
+import { cpSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { type LocalCommandResult, runLocalCommand } from "./local-command.js";
+
+export interface EmbeddedPostgresOwner {
+	readonly uid: number;
+	readonly gid: number;
+	readonly name: string;
+}
+
+export interface EmbeddedPostgresRunContext {
+	/** Directory that holds the cluster, log file, and setup locks. */
+	readonly baseDir: string;
+	/** Present only when commands must drop privileges (Linux root). */
+	readonly owner?: EmbeddedPostgresOwner;
+	/** Runs a command as the owner; identity pass-through when no owner. */
+	readonly runAsOwner: LocalCommandRunner;
+}
+
+export interface EmbeddedPostgresBinaryPaths {
+	readonly pg_ctl: string;
+	readonly initdb: string;
+}
+
+export type LocalCommandRunner = (
+	command: string,
+	args: readonly string[],
+	options?: { readonly uid?: number; readonly gid?: number },
+) => Promise<LocalCommandResult>;
+
+/** Root-safe cluster location: system path, traversable by system accounts. */
+export const ROOT_EMBEDDED_BASE_DIR = "/var/lib/atomic-postgres";
+
+/** Unprivileged accounts tried in order; `postgres` wins when present. */
+const OWNER_CANDIDATES = ["postgres", "nobody", "daemon"] as const;
+
+export function defaultEmbeddedBaseDir(): string {
+	return join(homedir(), ".atomic", "postgres");
+}
+
+/**
+ * Resolve where and as whom the embedded cluster should run. Non-root (and
+ * every non-Linux platform) keeps the historical home-directory layout. Linux
+ * root without a resolvable unprivileged account, or without any working
+ * privilege-drop mechanism, also falls through to the default context so
+ * PostgreSQL's own root refusal surfaces with full detail.
+ */
+export async function resolveEmbeddedRunContext(
+	runner: LocalCommandRunner = runLocalCommand,
+	euid: number | undefined = process.getuid?.(),
+	platform: NodeJS.Platform = process.platform,
+): Promise<EmbeddedPostgresRunContext> {
+	if (platform !== "linux" || euid !== 0) {
+		return { baseDir: defaultEmbeddedBaseDir(), runAsOwner: runner };
+	}
+	for (const name of OWNER_CANDIDATES) {
+		const owner = await lookupOwner(runner, name);
+		if (owner === undefined) continue;
+		const runAsOwner = await resolvePrivilegeDrop(runner, owner);
+		if (runAsOwner === undefined) continue;
+		return { baseDir: ROOT_EMBEDDED_BASE_DIR, owner, runAsOwner };
+	}
+	return { baseDir: defaultEmbeddedBaseDir(), runAsOwner: runner };
+}
+
+/**
+ * Return a runner that verifiably executes commands as the owner, or
+ * `undefined` when no drop mechanism works. Each strategy is validated by
+ * running `id -u` through it and requiring the owner's uid on stdout — the
+ * spawn `uid`/`gid` options in particular are silently ignored by Bun.
+ */
+export async function resolvePrivilegeDrop(
+	runner: LocalCommandRunner,
+	owner: EmbeddedPostgresOwner,
+): Promise<LocalCommandRunner | undefined> {
+	const strategies: readonly LocalCommandRunner[] = [
+		(command, args) => runner(command, args, { uid: owner.uid, gid: owner.gid }),
+		(command, args) =>
+			runner("setpriv", [`--reuid=${owner.uid}`, `--regid=${owner.gid}`, "--clear-groups", "--", command, ...args]),
+		(command, args) => runner("runuser", ["-u", owner.name, "--", command, ...args]),
+		(command, args) => runner("su", ["-s", "/bin/sh", "-c", shellCommand(command, args), owner.name]),
+	];
+	for (const strategy of strategies) {
+		const probe = await strategy("id", ["-u"]).catch(() => undefined);
+		if (probe !== undefined && probe.exitCode === 0 && probe.stdout.trim() === String(owner.uid)) {
+			return strategy;
+		}
+	}
+	return undefined;
+}
+
+/**
+ * Ensure the embedded binaries are executable by the drop-privilege owner.
+ * Probes `initdb --version` as the owner; on failure (typically an
+ * untraversable ancestor such as `/root`) copies the package's `native` tree
+ * into the cluster base directory once and reuses it afterwards.
+ */
+export async function prepareBinariesForOwner(
+	binaries: EmbeddedPostgresBinaryPaths,
+	context: EmbeddedPostgresRunContext,
+	runner: LocalCommandRunner = runLocalCommand,
+): Promise<EmbeddedPostgresBinaryPaths> {
+	const owner = context.owner;
+	if (owner === undefined) return binaries;
+
+	const probe = await context.runAsOwner(binaries.initdb, ["--version"]).catch(() => undefined);
+	if (probe !== undefined && probe.exitCode === 0) return binaries;
+
+	// `<packageRoot>/native/bin/initdb` → copy the whole `native` tree so the
+	// binaries keep their relative `../lib` runtime library references.
+	const nativeDir = dirname(dirname(binaries.initdb));
+	const copiedNativeDir = join(context.baseDir, "pg-runtime", "native");
+	const copied: EmbeddedPostgresBinaryPaths = {
+		pg_ctl: join(copiedNativeDir, "bin", "pg_ctl"),
+		initdb: join(copiedNativeDir, "bin", "initdb"),
+	};
+	if (!existsSync(copied.initdb)) {
+		cpSync(nativeDir, copiedNativeDir, { recursive: true });
+	}
+	const chown = await runner("chown", ["-R", `${owner.uid}:${owner.gid}`, join(context.baseDir, "pg-runtime")]);
+	if (chown.exitCode !== 0) {
+		throw new Error(
+			`Could not hand the copied embedded Postgres runtime to ${owner.name}: ${chown.stderr.trim() || chown.stdout.trim() || `exit ${chown.exitCode}`}`,
+		);
+	}
+	return copied;
+}
+
+async function lookupOwner(runner: LocalCommandRunner, name: string): Promise<EmbeddedPostgresOwner | undefined> {
+	const uid = await lookupId(runner, ["-u", name]);
+	const gid = await lookupId(runner, ["-g", name]);
+	if (uid === undefined || gid === undefined || uid === 0) return undefined;
+	return { uid, gid, name };
+}
+
+async function lookupId(runner: LocalCommandRunner, args: readonly string[]): Promise<number | undefined> {
+	try {
+		const result = await runner("id", args);
+		if (result.exitCode !== 0) return undefined;
+		const value = Number.parseInt(result.stdout.trim(), 10);
+		return Number.isInteger(value) && value > 0 ? value : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/** Single-quote a command line for `su -c`; arguments never embed user input. */
+function shellCommand(command: string, args: readonly string[]): string {
+	return [command, ...args].map((part) => `'${part.replaceAll("'", "'\\''")}'`).join(" ");
+}

package/dist/builtin/workflows/src/durable/dbos-embedded-postgres.ts

@@ -10,12 +10,34 @@
  * is started with `pg_ctl`, which daemonizes the server into its own session:
  * it survives Atomic exiting and is shared by every concurrent Atomic session.
  * Atomic never stops it.
+ *
+ * PostgreSQL refuses to run as UID 0, so a root Atomic process (containers,
+ * CI sandboxes, eval harnesses) resolves an unprivileged system account, keeps
+ * the cluster under `/var/lib/atomic-postgres` instead (a root home directory
+ * is untraversable for that account), and runs every Postgres command with
+ * dropped privileges. See dbos-embedded-postgres-root.ts.
  */
 
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import {
+	chmodSync,
+	chownSync,
+	copyFileSync,
+	existsSync,
+	mkdirSync,
+	readFileSync,
+	rmSync,
+	statSync,
+	symlinkSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { commandFailureDetail, delay, runLocalCommand, tcpReachable } from "./local-command.js";
+import {
+	type EmbeddedPostgresRunContext,
+	prepareBinariesForOwner,
+	resolveEmbeddedRunContext,
+} from "./dbos-embedded-postgres-root.js";
+import { commandFailureDetail, delay, tcpReachable } from "./local-command.js";
 
 const EMBEDDED_HOST = "127.0.0.1";
 const EMBEDDED_PORT = 5439;
@@ -26,82 +48,99 @@ const READY_ATTEMPTS = 120;
 const READY_DELAY_MS = 250;
 const SETUP_LOCK_STALE_MS = 120_000;
 
-export const EMBEDDED_DBOS_SYSTEM_DATABASE_URL =
-  `postgresql://${EMBEDDED_USER}:${EMBEDDED_PASSWORD}@${EMBEDDED_HOST}:${EMBEDDED_PORT}/atomic_workflows_dbos_sys?connect_timeout=10&sslmode=disable`;
+export const EMBEDDED_DBOS_SYSTEM_DATABASE_URL = `postgresql://${EMBEDDED_USER}:${EMBEDDED_PASSWORD}@${EMBEDDED_HOST}:${EMBEDDED_PORT}/atomic_workflows_dbos_sys?connect_timeout=10&sslmode=disable`;
 
 interface EmbeddedPostgresBinaries {
-  readonly pg_ctl: string;
-  readonly initdb: string;
+	readonly pg_ctl: string;
+	readonly initdb: string;
 }
 
 let ensured: Promise<void> | undefined;
 
 /** Start or attach to the shared embedded DBOS Postgres exactly once per process. */
 export function ensureEmbeddedDbosPostgres(): Promise<void> {
-  ensured ??= ensure().catch((error: unknown) => {
-    ensured = undefined;
-    throw error;
-  });
-  return ensured;
+	ensured ??= ensure().catch((error: unknown) => {
+		ensured = undefined;
+		throw error;
+	});
+	return ensured;
 }
 
 async function ensure(): Promise<void> {
-  if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-  const binaries = await loadEmbeddedPostgresBinaries();
-  hydrateBinaryLibraryLinks(binaries.pg_ctl);
-  const root = join(homedir(), ".atomic", "postgres");
-  const dataDir = join(root, `v${EMBEDDED_PG_MAJOR}`);
-  const logFile = join(root, `v${EMBEDDED_PG_MAJOR}.log`);
-  mkdirSync(root, { recursive: true, mode: 0o700 });
-
-  await withSetupLock(join(root, `v${EMBEDDED_PG_MAJOR}.setup-lock`), async () => {
-    if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-    if (!existsSync(join(dataDir, "PG_VERSION"))) await initializeCluster(binaries.initdb, dataDir);
-    await startCluster(binaries.pg_ctl, dataDir, logFile);
-  });
-
-  for (let attempt = 0; attempt < READY_ATTEMPTS; attempt += 1) {
-    if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
-    await delay(READY_DELAY_MS);
-  }
-  throw new Error(`Embedded Postgres started but never accepted connections on ${EMBEDDED_HOST}:${EMBEDDED_PORT}; see ${logFile}.`);
+	if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
+	const loaded = await loadEmbeddedPostgresBinaries();
+	hydrateBinaryLibraryLinks(loaded.pg_ctl);
+	const context = await resolveEmbeddedRunContext();
+	const root = context.baseDir;
+	const dataDir = join(root, `v${EMBEDDED_PG_MAJOR}`);
+	const logFile = join(root, `v${EMBEDDED_PG_MAJOR}.log`);
+	mkdirSync(root, { recursive: true, mode: 0o700 });
+	if (context.owner !== undefined) chownSync(root, context.owner.uid, context.owner.gid);
+	const binaries = await prepareBinariesForOwner(loaded, context);
+
+	await withSetupLock(join(root, `v${EMBEDDED_PG_MAJOR}.setup-lock`), async () => {
+		if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
+		if (!existsSync(join(dataDir, "PG_VERSION"))) await initializeCluster(binaries.initdb, dataDir, context);
+		await startCluster(binaries.pg_ctl, dataDir, logFile, context);
+	});
+
+	for (let attempt = 0; attempt < READY_ATTEMPTS; attempt += 1) {
+		if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT)) return;
+		await delay(READY_DELAY_MS);
+	}
+	throw new Error(
+		`Embedded Postgres started but never accepted connections on ${EMBEDDED_HOST}:${EMBEDDED_PORT}; see ${logFile}.`,
+	);
 }
 
-async function initializeCluster(initdb: string, dataDir: string): Promise<void> {
-  const passwordFile = join(tmpdir(), `atomic-pg-pw-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
-  writeFileSync(passwordFile, `${EMBEDDED_PASSWORD}\n`, { mode: 0o600 });
-  try {
-    const result = await runLocalCommand(initdb, [
-      "-D", dataDir,
-      "-U", EMBEDDED_USER,
-      "-A", "password",
-      `--pwfile=${passwordFile}`,
-      "-E", "UTF8",
-      "--no-locale",
-    ]);
-    if (result.exitCode !== 0) {
-      throw new Error(`Could not initialize the embedded Postgres cluster: ${commandFailureDetail(result)}`);
-    }
-  } finally {
-    rmSync(passwordFile, { force: true });
-  }
+async function initializeCluster(initdb: string, dataDir: string, context: EmbeddedPostgresRunContext): Promise<void> {
+	const passwordFile = join(tmpdir(), `atomic-pg-pw-${process.pid}-${crypto.randomUUID().slice(0, 8)}`);
+	writeFileSync(passwordFile, `${EMBEDDED_PASSWORD}\n`, { mode: 0o600 });
+	try {
+		if (context.owner !== undefined) chownSync(passwordFile, context.owner.uid, context.owner.gid);
+		const result = await context.runAsOwner(initdb, [
+			"-D",
+			dataDir,
+			"-U",
+			EMBEDDED_USER,
+			"-A",
+			"password",
+			`--pwfile=${passwordFile}`,
+			"-E",
+			"UTF8",
+			"--no-locale",
+		]);
+		if (result.exitCode !== 0) {
+			throw new Error(`Could not initialize the embedded Postgres cluster: ${commandFailureDetail(result)}`);
+		}
+	} finally {
+		rmSync(passwordFile, { force: true });
+	}
 }
 
-async function startCluster(pgCtl: string, dataDir: string, logFile: string): Promise<void> {
-  const result = await runLocalCommand(pgCtl, [
-    "-D", dataDir,
-    "-l", logFile,
-    "-o", `-p ${EMBEDDED_PORT} -c listen_addresses=${EMBEDDED_HOST}`,
-    "-w", "-t", "60",
-    "start",
-  ]);
-  if (result.exitCode === 0) return;
-  // A concurrent session may have won the start race; readiness polling in the
-  // caller decides. Only fail here when nothing is coming up on the port.
-  if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT, 3_000)) return;
-  throw new Error(
-    `Could not start the embedded Postgres cluster: ${commandFailureDetail(result)}${logTail(logFile)}`,
-  );
+async function startCluster(
+	pgCtl: string,
+	dataDir: string,
+	logFile: string,
+	context: EmbeddedPostgresRunContext,
+): Promise<void> {
+	const result = await context.runAsOwner(pgCtl, [
+		"-D",
+		dataDir,
+		"-l",
+		logFile,
+		"-o",
+		`-p ${EMBEDDED_PORT} -c listen_addresses=${EMBEDDED_HOST}`,
+		"-w",
+		"-t",
+		"60",
+		"start",
+	]);
+	if (result.exitCode === 0) return;
+	// A concurrent session may have won the start race; readiness polling in the
+	// caller decides. Only fail here when nothing is coming up on the port.
+	if (await tcpReachable(EMBEDDED_HOST, EMBEDDED_PORT, 3_000)) return;
+	throw new Error(`Could not start the embedded Postgres cluster: ${commandFailureDetail(result)}${logTail(logFile)}`);
 }
 
 /**
@@ -112,96 +151,103 @@ async function startCluster(pgCtl: string, dataDir: string, logFile: string): Pr
  * the links at runtime; fall back to copying when symlinks are unavailable.
  */
 function hydrateBinaryLibraryLinks(pgCtlPath: string): void {
-  const packageRoot = dirname(dirname(dirname(pgCtlPath)));
-  let manifest: readonly { readonly source: string; readonly target: string }[];
-  try {
-    manifest = JSON.parse(readFileSync(join(packageRoot, "native", "pg-symlinks.json"), "utf8")) as typeof manifest;
-  } catch {
-    return;
-  }
-  for (const { source, target } of manifest) {
-    const absoluteSource = join(packageRoot, source);
-    const absoluteTarget = join(packageRoot, target);
-    if (existsSync(absoluteTarget) || !existsSync(absoluteSource)) continue;
-    try {
-      symlinkSync(relative(dirname(absoluteTarget), absoluteSource), absoluteTarget);
-    } catch {
-      try {
-        copyFileSync(absoluteSource, absoluteTarget);
-      } catch {
-        // Missing optional libraries surface as an initdb/pg_ctl failure with detail.
-      }
-    }
-  }
+	const packageRoot = dirname(dirname(dirname(pgCtlPath)));
+	let manifest: readonly { readonly source: string; readonly target: string }[];
+	try {
+		manifest = JSON.parse(readFileSync(join(packageRoot, "native", "pg-symlinks.json"), "utf8")) as typeof manifest;
+	} catch {
+		return;
+	}
+	for (const { source, target } of manifest) {
+		const absoluteSource = join(packageRoot, source);
+		const absoluteTarget = join(packageRoot, target);
+		if (existsSync(absoluteTarget) || !existsSync(absoluteSource)) continue;
+		try {
+			symlinkSync(relative(dirname(absoluteTarget), absoluteSource), absoluteTarget);
+		} catch {
+			try {
+				copyFileSync(absoluteSource, absoluteTarget);
+			} catch {
+				// Missing optional libraries surface as an initdb/pg_ctl failure with detail.
+			}
+		}
+	}
 }
 
 async function loadEmbeddedPostgresBinaries(): Promise<EmbeddedPostgresBinaries> {
-  const platform = process.platform === "win32" ? "windows" : process.platform;
-  const packageName = `@embedded-postgres/${platform}-${process.arch}`;
-  let binaries: Partial<EmbeddedPostgresBinaries>;
-  try {
-    binaries = await import(packageName) as Partial<EmbeddedPostgresBinaries>;
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    throw new Error(`Embedded Postgres binaries are unavailable for ${process.platform}/${process.arch} (${packageName}): ${detail}`);
-  }
-  if (typeof binaries.pg_ctl !== "string" || typeof binaries.initdb !== "string") {
-    throw new Error(`Embedded Postgres package ${packageName} did not export pg_ctl/initdb paths.`);
-  }
-  for (const binary of [binaries.pg_ctl, binaries.initdb, join(dirname(binaries.pg_ctl), process.platform === "win32" ? "postgres.exe" : "postgres")]) {
-    ensureExecutable(binary);
-  }
-  return { pg_ctl: binaries.pg_ctl, initdb: binaries.initdb };
+	const platform = process.platform === "win32" ? "windows" : process.platform;
+	const packageName = `@embedded-postgres/${platform}-${process.arch}`;
+	let binaries: Partial<EmbeddedPostgresBinaries>;
+	try {
+		binaries = (await import(packageName)) as Partial<EmbeddedPostgresBinaries>;
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Error(
+			`Embedded Postgres binaries are unavailable for ${process.platform}/${process.arch} (${packageName}): ${detail}`,
+		);
+	}
+	if (typeof binaries.pg_ctl !== "string" || typeof binaries.initdb !== "string") {
+		throw new Error(`Embedded Postgres package ${packageName} did not export pg_ctl/initdb paths.`);
+	}
+	for (const binary of [
+		binaries.pg_ctl,
+		binaries.initdb,
+		join(dirname(binaries.pg_ctl), process.platform === "win32" ? "postgres.exe" : "postgres"),
+	]) {
+		ensureExecutable(binary);
+	}
+	return { pg_ctl: binaries.pg_ctl, initdb: binaries.initdb };
 }
 
 /** npm can strip executable bits; restore them only when actually missing. */
 function ensureExecutable(filePath: string): void {
-  try {
-    const mode = statSync(filePath).mode;
-    if ((mode & 0o111) !== 0o111) chmodSync(filePath, mode | 0o555);
-  } catch {
-    // A genuinely missing binary surfaces as a spawn failure with detail.
-  }
+	try {
+		const mode = statSync(filePath).mode;
+		if ((mode & 0o111) !== 0o111) chmodSync(filePath, mode | 0o555);
+	} catch {
+		// A genuinely missing binary surfaces as a spawn failure with detail.
+	}
 }
 
 /** Serialize initdb/start across concurrent Atomic processes on this machine. */
 async function withSetupLock(lockDir: string, fn: () => Promise<void>): Promise<void> {
-  for (let attempt = 0; attempt < READY_ATTEMPTS; attempt += 1) {
-    try {
-      mkdirSync(lockDir);
-      break;
-    } catch {
-      if (lockIsStale(lockDir)) {
-        rmSync(lockDir, { recursive: true, force: true });
-        continue;
-      }
-      await delay(READY_DELAY_MS);
-      if (attempt === READY_ATTEMPTS - 1) throw new Error(`Timed out waiting for another Atomic process to finish Postgres setup (${lockDir}).`);
-    }
-  }
-  try {
-    await fn();
-  } finally {
-    rmSync(lockDir, { recursive: true, force: true });
-  }
+	for (let attempt = 0; attempt < READY_ATTEMPTS; attempt += 1) {
+		try {
+			mkdirSync(lockDir);
+			break;
+		} catch {
+			if (lockIsStale(lockDir)) {
+				rmSync(lockDir, { recursive: true, force: true });
+				continue;
+			}
+			await delay(READY_DELAY_MS);
+			if (attempt === READY_ATTEMPTS - 1)
+				throw new Error(`Timed out waiting for another Atomic process to finish Postgres setup (${lockDir}).`);
+		}
+	}
+	try {
+		await fn();
+	} finally {
+		rmSync(lockDir, { recursive: true, force: true });
+	}
 }
 function lockIsStale(lockDir: string): boolean {
-  try {
-    return Date.now() - statSync(lockDir).mtimeMs > SETUP_LOCK_STALE_MS;
-  } catch {
-    return false;
-  }
+	try {
+		return Date.now() - statSync(lockDir).mtimeMs > SETUP_LOCK_STALE_MS;
+	} catch {
+		return false;
+	}
 }
 
 function logTail(logFile: string): string {
-  try {
-    const lines = readFileSync(logFile, "utf8").trimEnd().split("\n");
-    return `\nPostgres log tail:\n${lines.slice(-5).join("\n")}`;
-  } catch {
-    return "";
-  }
+	try {
+		const lines = readFileSync(logFile, "utf8").trimEnd().split("\n");
+		return `\nPostgres log tail:\n${lines.slice(-5).join("\n")}`;
+	} catch {
+		return "";
+	}
 }
 
 export function resetEmbeddedDbosPostgresForTests(): void {
-  ensured = undefined;
+	ensured = undefined;
 }