From 59047e5072ad4cd34cdb45ee16ab9ed05075c267 Mon Sep 17 00:00:00 2001
From: Admin <dmparrow@gmail.com>
Date: Mon, 21 Sep 2026 21:56:25 +0000
Subject: [PATCH] Allow annoNet migrations on restricted PostgreSQL

---
 Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index be048a4..affd011 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,10 @@ WORKDIR /src
 COPY annonet-arrowstack-ready.zip /tmp/annonet.zip
 RUN unzip -q /tmp/annonet.zip -d /src
 COPY mcpAuthMiddleware.js /src/src/auth/mcpAuthMiddleware.js
+# Arrowstack's database-per-tenant runtime role intentionally cannot install
+# extensions. PostgreSQL 13+ provides gen_random_uuid() in core, and annoNet
+# does not use any other pgcrypto functions.
+RUN sed -i '/^CREATE EXTENSION IF NOT EXISTS pgcrypto;$/d' /src/sql/001_init.sql
 
 FROM node:22-alpine AS frontend-build
 WORKDIR /build/frontend-astro