From e2a68b1ca70ffd8eb002890b9c02445adb032a34 Mon Sep 17 00:00:00 2001
From: choldgraf <choldgraf@gmail.com>
Date: Tue, 25 Aug 2026 11:26:24 -0700
Subject: [PATCH] Mount the secret as jovyan so it can be copied

---
 appendix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/appendix b/appendix
index f46e321..70d032b 100644
--- a/appendix
+++ b/appendix
@@ -53,7 +53,9 @@ RUN cp /srv/repo/custom_jupyter_server_config.json ${NB_PYTHON_PREFIX}/etc/jupyt
 
 # Mothership GCP service account key — workshop-scoped, revoked after.
 # required=false so PR/test builds (which never receive this secret) don't fail.
-RUN --mount=type=secret,id=gcp_key,required=false \
+# We use uid=1000 because this step is run as jovyan, and BuildKit mounts
+# secrets as owned by root by default, so this lets jovyan read them.
+RUN --mount=type=secret,id=gcp_key,required=false,uid=1000 \
     if [ -s /run/secrets/gcp_key ]; then \
         mkdir -p ${NB_PYTHON_PREFIX}/etc/gcp && \
         cp /run/secrets/gcp_key ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json && \