images/postfix-pgsql/README.md

@@ -27,6 +27,13 @@ On startup, the entrypoint renders three files from templates under
 - `/etc/postfix/pgsql-transport-maps.cf` — PostgreSQL lookup that tells
   Postfix where to forward accepted mail (the internal SMTP relay target).
 
+Chroot is disabled for all Postfix services via `postconf -F '*/*/chroot = n'`
+on every startup. Postfix's chrooted child processes (smtpd, trivial-rewrite,
+etc.) lack access to `/etc/resolv.conf` inside the chroot jail, so they cannot
+resolve Docker-internal hostnames — causing every PostgreSQL lookup to fail with
+`451 4.3.0 Temporary lookup failure`. Disabling chroot is the standard remedy
+in containerised deployments.
+
 ## Environment variables
 
 ### Required

images/postfix-pgsql/docker-entrypoint.sh

@@ -59,4 +59,10 @@ chmod 640 /etc/postfix/pgsql-relay-domains.cf /etc/postfix/pgsql-transport-maps.
 
 postfix check
 
+# Disable chroot for all master.cf services so child processes (smtpd,
+# trivial-rewrite, etc.) can resolve Docker-internal hostnames via the host's
+# /etc/resolv.conf. Without this, chrooted processes have no DNS and every
+# pgsql lookup returns "451 4.3.0 Temporary lookup failure".
+postconf -F '*/*/chroot = n'
+
 exec /usr/sbin/postfix start-fg