fix: keep OpenTelemetry running when resource detection is incomplete

[Timo972]

Root cause

The runtime image runs as USER 65532:65532, but debian:bookworm-slim has no account at that UID:

$ docker run --rm --user 65532:65532 debian:bookworm-slim getent passwd 65532
NO PASSWD ENTRY FOR 65532

So OTel's processOwnerDetector calls user.Current(), which fails, resource.New returns that error, and Init treated it as fatal — disabling telemetry in every container.

Why the obvious guard would not have worked

The SDK's own documented pattern is errors.Is(err, resource.ErrPartialResource). That does not catch this case — processOwnerDetector.Detect returns user.Current()'s error verbatim, unwrapped:

func (processOwnerDetector) Detect(context.Context) (*Resource, error) {
	owner, err := owner()
	if err != nil {
		return nil, err   // not wrapped in ErrPartialResource
	}
	...
}

detect() joins the error but still merges every other detector, so the resource keeps env, PID, executable, command args, runtime, host and service.name — only process.owner is missing. An incomplete resource is a degraded one, not an invalid one.

Changes

• internal/telemetry/otel.go — log detection failures as a warning and continue with the resource, instead of aborting startup.
• Dockerfile — create the nonroot account the numeric USER refers to, so the lookup actually succeeds and process.owner is populated rather than merely tolerated. USER stays numeric so Kubernetes runAsNonRoot can verify it.

Verification

End-to-end, real binary under --user 65532:65532 with OTEL_EXPORTER_OTLP_ENDPOINT set:

build	result
pre-fix	application stopped with an error: initialize telemetry failed
post-fix, no passwd entry	WARN incomplete telemetry resource → INFO telemetry initialized → startup continues
post-fix, with passwd entry	INFO telemetry initialized, no warning — owner resolves

Confirmed the image change works with CGO_ENABLED=0 (pure-Go os/user reads /etc/passwd), which is how this binary ships.

Added TestInitKeepsPartialResourceWhenDetectionFails, written first and watched fail with the exact production error before the fix. go vet ./..., go test -race ./..., go build ./cmd/app, and gofmt are all clean.

🤖 Generated with Claude Code