Local mails use Supabase's default templates instead of ours (on SELinux hosts)

[cies]

Symptoms (any of):

• A magic link or password reset mail in Mailpit (http://localhost:54324) looks nothing like
  supabase/templates/*.mustache: no DropNext styling, and the link points at
  http://127.0.0.1:54321/auth/v1/verify?token=… instead of the app's /auth-return.
• The auth container's log repeats
  templatemailer_template_body_http_error ... /email/magic_link.mustache: status code 403
  (docker logs $(docker ps -q --filter ancestor=public.ecr.aws/supabase/gotrue:v2.195.0), adjust the tag).

Root cause: the CLI bind-mounts the template files into the Kong container and GoTrue fetches
them from Kong on every send. The mount carries no :z relabel, so on a host with SELinux
enforcing (the repo's files are labelled mnt_t when the checkout lives on its own mount) Kong
gets "Permission denied" on files that are world-readable, answers 403, and GoTrue silently
falls back to its built-in templates. Nothing fails loudly, the mail is just a different mail.

Workaroud: relabel the template files so containers may read them (reversible with restorecon):

chcon -t container_file_t supabase/templates/*.mustache

Bug report

This should not be so hard. I think the mounts should carry a :z label so this gets easier.

[breken-ai]

confirmed the RCA end to end. the bind is generated in the CLI (now the TypeScript rewrite) at apps/cli/src/commands/start/services/kong.service.ts (buildKongEmailTemplateBind) as <hostPath>:<dockerPath>:rw - no relabel option, so on an SELinux-enforcing host Kong (container_t) can't read project files labelled mnt_t and answers 403; gotrue's template mailer then logs templatemailer_template_body_http_error and silently falls back to the built-in templates. that fallback is why nothing fails loudly even though every mail is wrong.

fix shipped as a PR on the CLI repo (the mount lives there, not in gotrue): append the shared relabel flag (z) to the generated bind - exactly the :z you proposed. docker and podman both treat the flag as a no-op when SELinux is disabled, so non-SELinux hosts are unaffected; z (shared) rather than Z (private) since the same path may be mounted by other containers.

one note on the mailer side: the templatemailer_template_body_http_error log line is the only signal that templates are being ignored. a one-level-louder log (warn) or a health surface would turn this class of config error from silent-wrong-mail into an obvious startup symptom - but the mount relabel fixes the reported bug as-is.

supabase/cli#6536

Built by breken, your AI support engineer - breken.ai finds the bug, proves the fix with unmatched RCA, answers customers in your voice, and keeps your code and support docs clean - this one's on us.