{{ message }}
Repository navigation
Local mails use Supabase's default templates instead of ours (on SELinux hosts) #2783
Description
Symptoms (any of):
- A magic link or password reset mail in Mailpit (
http://localhost:54324) looks nothing like
supabase/templates/*.mustache: no DropNext styling, and the link points at
http://127.0.0.1:54321/auth/v1/verify?token=…instead of the app's/auth-return. - The auth container's log repeats
templatemailer_template_body_http_error ... /email/magic_link.mustache: status code 403
(docker logs $(docker ps -q --filter ancestor=public.ecr.aws/supabase/gotrue:v2.195.0), adjust the tag).
Root cause: the CLI bind-mounts the template files into the Kong container and GoTrue fetches
them from Kong on every send. The mount carries no :z relabel, so on a host with SELinux
enforcing (the repo's files are labelled mnt_t when the checkout lives on its own mount) Kong
gets "Permission denied" on files that are world-readable, answers 403, and GoTrue silently
falls back to its built-in templates. Nothing fails loudly, the mail is just a different mail.
Workaroud: relabel the template files so containers may read them (reversible with restorecon):
chcon -t container_file_t supabase/templates/*.mustacheBug report
This should not be so hard. I think the mounts should carry a :z label so this gets easier.
Activity
breken-ai commentedon Sep 9, 2026
confirmed the RCA end to end. the bind is generated in the CLI (now the TypeScript rewrite) at apps/cli/src/commands/start/services/kong.service.ts (buildKongEmailTemplateBind) as
<hostPath>:<dockerPath>:rw- no relabel option, so on an SELinux-enforcing host Kong (container_t) can't read project files labelled mnt_t and answers 403; gotrue's template mailer then logs templatemailer_template_body_http_error and silently falls back to the built-in templates. that fallback is why nothing fails loudly even though every mail is wrong.fix shipped as a PR on the CLI repo (the mount lives there, not in gotrue): append the shared relabel flag (
z) to the generated bind - exactly the:zyou proposed. docker and podman both treat the flag as a no-op when SELinux is disabled, so non-SELinux hosts are unaffected;z(shared) rather thanZ(private) since the same path may be mounted by other containers.one note on the mailer side: the templatemailer_template_body_http_error log line is the only signal that templates are being ignored. a one-level-louder log (warn) or a health surface would turn this class of config error from silent-wrong-mail into an obvious startup symptom - but the mount relabel fixes the reported bug as-is.
supabase/cli#6536
Built by breken, your AI support engineer - breken.ai finds the bug, proves the fix with unmatched RCA, answers customers in your voice, and keeps your code and support docs clean - this one's on us.