Shipping config files in

Two files name the same path. echo/fly.toml sets ERL_INETRC = "/app/inetrc" — the path Erlang’s resolver reads at boot to learn how to see Fly’s private DNS. echo/Dockerfile must place a file there with COPY infra/inetrc /app/inetrc. Neither file checks the other. If the destination drifts by one segment, docker build still succeeds and the image still ships; the fault surfaces only when the booted release evaluates ERL_INETRC, finds nothing at the named path, and logs inet_config: file /app/inetrc not found. The build is green, the boot is dead.

The contents of echo/infra/inetrc — the resolver order {lookup, [native, file, dns]}, Fly’s fdaa::3 nameserver, and {search, ["internal"]} — are F7.2’s depth. This dive is about getting the file to the path, not what the file says.

Both traps follow from the same fact: the runtime stage opens with its own FROM, so it starts from a clean slate. It inherits no working directory and no user from the build stage. Trap A — a COPY infra/inetrc ./inetrc placed before WORKDIR /app resolves the relative destination against Debian’s default working directory, which is /, so the file lands at /inetrc and the env var still points at nothing. Trap B — a COPY --chown=app:app … fails the build with unable to find user app, because the slim runtime stage creates no app user and the release itself was copied unchowned, running as root. Set both toggles and read which of the three outcomes you get.

The runtime stage ends in four lines: set the working directory, copy the release in, copy the config file to its absolute path, then declare the port and the entry point. The two broken variants are shown first, annotated, so the failure mode is visible beside the fix. The COPY infra/inetrc /app/inetrc comes after WORKDIR /app and after the release COPY (a directory copy merges and will not overwrite it), with no --chown — matching how the release itself is copied into a stage that runs as root.