Update fix

docker-compose.yml

@@ -98,7 +98,11 @@ services:
       # Allow guest from host.docker.internal / CI runner (dev only).
       - ./infra/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
     healthcheck:
-      test: ["CMD", "rabbitmq-diagnostics", "ping"]
+      # The image sets no USER, so healthchecks run as root. Any Erlang tool creates
+      # $HOME/.erlang.cookie (mode 400) if it is absent — and HOME is /var/lib/rabbitmq
+      # for root too. A root-run check that beats the booting server to the cookie
+      # locks the broker out of its own file: "reading .erlang.cookie: eacces".
+      test: ["CMD-SHELL", "su rabbitmq -s /bin/sh -c 'rabbitmq-diagnostics -q ping'"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -193,7 +197,8 @@ services:
     volumes:
       - ./infra/rabbitmq/rabbitmq.conf:/etc/rabbitmq/rabbitmq.conf:ro
     healthcheck:
-      test: ["CMD", "rabbitmq-diagnostics", "ping"]
+      # Drops to rabbitmq for the same .erlang.cookie reason as the rabbitmq service.
+      test: ["CMD-SHELL", "su rabbitmq -s /bin/sh -c 'rabbitmq-diagnostics -q ping'"]
       interval: 10s
       timeout: 5s
       retries: 5