From 8516009ec7b707f02db453a3fde45bcebb1bc9dd Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 25 Aug 2026 09:08:55 +0000
Subject: [PATCH] chore: move the compose stack to postgres 18

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ha6ovKdT9XRoj5FyVe7fEt
---
 docker-compose.yml | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index a801a0ce7c..48a55e8c3d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,15 +8,46 @@ x-logging: &default-logging
     compress: "true"
 
 services:
+  ## UPGRADING AN EXISTING STACK: a db_data volume written by postgres:16 holds a
+  ## cluster that 18 cannot read. The container exits with an explanatory error
+  ## instead of coming up blank, so nothing is lost before you migrate. Postgres 16
+  ## is supported upstream until Nov 2028, so staying on `image: postgres:16` with
+  ## the old `db_data:/var/lib/postgresql/data` mount remains a valid option.
+  ##
+  ## To move the data across, dump first while the old 16 container is still the
+  ## one running (git checkout the previous docker-compose.yml if you already
+  ## replaced it), with only db up:
+  ##   docker compose stop windmill_server windmill_worker windmill_worker_native
+  ##   docker compose exec -T db pg_dumpall -U postgres --globals-only --no-role-passwords > globals.sql
+  ##   docker compose exec -T db pg_dump -U postgres -Fc windmill > windmill.dump
+  ## Check both files, then switch to this file and start 18 on an empty volume:
+  ##   docker compose down
+  ##   docker volume ls | grep db_data     # then remove the one this project owns
+  ##   docker volume rm <that_volume>
+  ##   docker compose up -d db
+  ##   docker compose exec -T db psql -U postgres -d postgres < globals.sql
+  ##   docker compose exec -T db pg_restore -U postgres -d windmill --no-owner --exit-on-error < windmill.dump
+  ##   docker compose up -d
+  ## Loading globals.sql is not optional. Windmill grants its row-level security
+  ## policies to the cluster-level windmill_admin and windmill_user roles, which a
+  ## database-only dump does not carry, and pg_restore silently drops every policy
+  ## whose grantee role is missing. The one error to expect is psql reporting
+  ## `role "postgres" already exists`, which the fresh cluster bootstraps itself.
   db:
     deploy:
       # To use an external database, set replicas to 0 and set DATABASE_URL to the external database url in the .env file
       replicas: 1
-    image: postgres:16
+    image: postgres:18
     shm_size: 1g
     restart: unless-stopped
     volumes:
-      - db_data:/var/lib/postgresql/data
+      # From 18 on the official image keeps the cluster in a major-version
+      # subdirectory (/var/lib/postgresql/18/docker), so the mount has to be the
+      # parent directory: that is what lets pg_upgrade see an old and a new
+      # cluster inside a single mount point. Mounting the pre-18 .../data path
+      # instead makes the image exit rather than start, which is what turns a
+      # stale 16 cluster into a loud failure instead of an empty instance.
+      - db_data:/var/lib/postgresql
     expose:
       - 5432
     environment: