The credential was baked into the image: files/Dockerfile appended xwiki.superadminpassword to WEB-INF/xwiki.cfg from a build arg. The swarm matrix rotates it between passes, so the manager rebuilds the image with the new value, but 'docker stack deploy --resolve-image never' leaves the mutable tag untouched and a worker that already holds it never re-pulls. The task keeps serving the pre-rotation password and answers 401 to every authenticated call the deploy makes next, which is where both XWiki jobs of run 33445831564 died: 03_administrator.yml:7 and 04_extensions.yml:25, after 31 attempts each.
The entrypoint writes it at start instead, from the environment the role already renders into templates/env.j2 and that sys-svc-container/templates/base.yml.j2 attaches as env_file. Both copies of xwiki.cfg are written, because the stock entrypoint restores the data volume over WEB-INF on every start but the first; writing only WEB-INF would survive one boot and be reverted by the next. The keys are deleted and re-appended rather than substituted, so a generated password never reaches a sed replacement.
Read from xwiki/xwiki-docker at master to settle three assumptions: other_starts() does restore xwiki.cfg, the stock entrypoint never touches the superadmin keys, and CONTEXT_PATH defaults to ROOT. The delete pattern was exercised against all four key spellings xwiki_replace accepts, and a password carrying sed metacharacters was verified to arrive byte for byte.
Dropping the build arg also keeps the credential out of the image history.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The stock xwiki entrypoint restores WEB-INF/xwiki.properties from the data volume and then rewrites it in place; mounting our rendered config read-only over WEB-INF (a swarm config object) makes that writeback fail with 'Read-only file system' and the service never converges. Add an entrypoint wrapper that copies the config (now mounted at /etc/infinito/xwiki.properties) into /usr/local/xwiki/data and lets the stock entrypoint own WEB-INF. Stage the wrapper into the compose build context the same way web-app-jenkins does. Validated in-container: config loaded, no read-only error, Tomcat starts. Compose is unaffected: the wrapper copies then execs the stock entrypoint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5