@toa.io/operations 1.0.0-alpha.289 → 1.0.0-alpha.290

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [1.0.0-alpha.290](https://github.com/toa-io/toa/compare/v1.0.0-alpha.289...v1.0.0-alpha.290) (2026-09-07)
+
+* fix(operations)!: an image starts as root again ([9eb0db7](https://github.com/toa-io/toa/commit/9eb0db75e3d02098fe75710280e8e15e63b73d57))
+* The runtime's environment is not a component's (#1070), closes [#1070](https://github.com/toa-io/toa/issues/1070)
+
+### BREAKING CHANGES
+
+* a component that read `process.env.TOA_*` reads `context` instead;
+  `echo(input)` no longer substitutes from the environment; a bash operation sees no
+  `TOA_*`; images no longer set `USER node` — see migrations/289.md.
+* an image built by alpha.289 runs its composition as `node` and
+  leaves the deployed environment readable under /proc; rebuild on 290. Nothing in
+  a context or a manifest changes.
+
+
 # [1.0.0-alpha.289](https://github.com/toa-io/toa/compare/v1.0.0-alpha.288...v1.0.0-alpha.289) (2026-09-07)
 
 * A deploy moves only what changed, and a component sees none of the runtime's environment (#1073) ([f38e3db](https://github.com/toa-io/toa/commit/f38e3db533f24db866c57bfa1ef294eff1eaf499)), closes [#1073](https://github.com/toa-io/toa/issues/1073) [#1064](https://github.com/toa-io/toa/issues/1064) [#1066](https://github.com/toa-io/toa/issues/1066) [#1067](https://github.com/toa-io/toa/issues/1067) [#1068](https://github.com/toa-io/toa/issues/1068) [#1069](https://github.com/toa-io/toa/issues/1069) [#1071](https://github.com/toa-io/toa/issues/1071) [#1070](https://github.com/toa-io/toa/issues/1070) [#1072](https://github.com/toa-io/toa/issues/1072)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/operations",
-  "version": "1.0.0-alpha.289",
+  "version": "1.0.0-alpha.290",
   "type": "module",
   "description": "Toa Deployment",
   "homepage": "https://toa.io",
@@ -32,5 +32,5 @@
     "@toa.io/norm": "1.0.0-alpha.289",
     "js-yaml": "5.4.1"
   },
-  "gitHead": "4fcb482beac5896305d8084cdbc1d5fcf372d108"
+  "gitHead": "c20cb1beb8d6e2bd3194385fbd57c71617a02bfb"
 }

package/src/deployment/images/composition.Dockerfile

@@ -6,5 +6,6 @@ FROM {{build.image}}
 # and the runtime reads its sources, it does not write them
 COPY --link . /composition
 
-USER node
+# no USER: the runtime drops to `node` itself, and only a process that started as root can
+# close its environment under /proc — see runtime/runtime/bin/toa
 CMD toa compose *

package/src/deployment/images/dependencies.test.js

@@ -155,10 +155,11 @@ describe('prepare', () => {
       .split('\n')
       .filter((line) => line !== '' && !line.startsWith('#'))
 
+    // no USER: the runtime starts as root and drops to `node` itself, and nothing else
+    // touches the filesystem, which is what lets the layer be laid over a base never pulled
     assert.deepStrictEqual(lines, [
       `FROM ${image.dependencies.reference}`,
       'COPY --link . /composition',
-      'USER node',
       'CMD toa compose *'
     ])
 
@@ -180,6 +181,7 @@ describe('prepare', () => {
     const dockerfile = await readFile(join(context, 'Dockerfile'), 'utf8')
 
     assert.ok(dockerfile.includes('CMD toa mono *'))
+    assert.doesNotMatch(dockerfile, /^USER /m)
   })
 })
 

package/src/deployment/images/mono.Dockerfile

@@ -6,5 +6,6 @@ FROM {{build.image}}
 # and the runtime reads its sources, it does not write them
 COPY --link . /composition
 
-USER node
+# no USER: the runtime drops to `node` itself, and only a process that started as root can
+# close its environment under /proc — see runtime/runtime/bin/toa
 CMD toa mono *