Replaces the misc/build.func bootstrap with the two-root core loader.
No other change: the engine contract (var_*, update_script, start,
build_container, description) is identical on both engines.
DocuSeal switched to its own PDFium fork (upstream commit "adjust pdfium",
2026-08-15) and now attaches functions that only exist in that build, e.g.
FPDFPage_GetAnnotCountRaw from the added fpdf_annots_raw.h. The generic
bblanchon/pdfium-binaries library the script installed does not export them,
so lib/pdfium.rb raises FFI::NotFoundError while Rails eager-loads and both
docuseal.service and docuseal-sidekiq.service fail to start:
Unable to load application: FFI::NotFoundError: Function
'FPDFPage_GetAnnotCountRaw' not found in [libpdfium.so]
Install the library from docusealco/pdfium-binaries instead, matching the
upstream Dockerfile. It is only published as a musl build (DocuSeal's image is
Alpine based), so the musl runtime is installed and its library directory is
added to the loader search path - the shared object needs "libc.so" (musl) at
dlopen time. Verified on glibc: the library loads, resolves the raw annotation
functions and renders pages correctly.
The update path now refreshes PDFium too, so existing containers are repaired
by running "update" even when DocuSeal itself is already up to date.
SECRET_KEY_BASE_DUMMY forced Rails to write tmp/local_secret.txt, which failed with EACCES during update and aborted db:migrate. Drop the dummy flag so the real SECRET_KEY_BASE from .env is used, and ensure tmp exists.
When running in certain LXC environments (e.g. systems with desktop
packages or non-en locales), the HOME variable may resolve to '/'
instead of '/root'. rbenv installs to $HOME/.rbenv, so if HOME is
wrong it ends up in /.rbenv while all service files and PATH exports
hardcode /root/.rbenv, causing 'env: ruby: No such file or directory'.
Explicitly set HOME=/root for all setup_ruby calls that run as root,
and replace all $HOME/.rbenv references in PATH exports and install
steps with /root/.rbenv literals.
Affected scripts:
- ct/sure.sh + install/sure-install.sh (fixes#14479)
- ct/dawarich.sh + install/dawarich-install.sh
- ct/docuseal.sh + install/docuseal-install.sh
Also add TimeoutStartSec=300 to sure.service so db:prepare on first
start does not get killed by the default 90s systemd timeout.
