Repository navigation
Deep-test fixes: ro cert-mount crash, wasm variant repair, duplicate Cache-Control, README accuracy - #6
Merged
Conversation
… README accuracy Deep-test fixes from QA of the published image and build flows: - docker-entrypoint.sh: unconditional `chmod` crashed the container when certs were bind-mounted read-only (the exact flow the README documents for Let's Encrypt). chmod now happens only where files are written, and is best-effort for pre-existing (possibly :ro) certs. Also warn when only one of SSL_CERT/SSL_KEY is set instead of silently ignoring it. - nginx.conf: `expires` + `add_header Cache-Control` emitted two conflicting Cache-Control headers on every asset/HTML response; collapse to a single explicit Cache-Control per location. - Dockerfile.wasm: spin-server build broke (Fermyon install.sh now needs git); component cache was never copied into the runtime stages, so the image fetched the fileserver from the internet on every boot (and wasm-scratch COPY pointed at a nonexistent /root/.spin/cache). - spin/spin.toml: invalid Spin v2 manifest ([component.fileserver.files] table instead of a `files` array) and a corrupted component digest; runtime failed to parse/verify. Verified serving with --network none. - README/Dockerfile comments: base image is Debian nginx:1.27 (not alpine, not ~25 MB); document the public GHCR multi-arch image and the build-context constraint on STATIC_FILES_PATH. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
QA deep-test of the published image (
ghcr.io/companionintelligence/ci-static-containter-builder:latest) and both build flows. All issues below were reproduced before fixing and re-verified after.Bugs fixed
-v …fullchain.pem:/etc/nginx/ssl/server.crt:ro) exited withchmod: Read-only file systembecauseset -e+ unconditionalchmod. chmod now lives in the branches that write files and is best-effort for pre-existing certs. Verified::romount now serves 200 over HTTPS.SSL_CERT/SSL_KEYis set — now logs a WARNING before generating a self-signed cert.Cache-Controlheaders (nginx.conf) —expires+add_header Cache-Controlsent two conflicting values on every asset (max-age=31536000+public, immutable) and HTML response. Collapsed to one explicit header per location.Dockerfile.wasmno longer built — Fermyon'sinstall.shnow requiresgit(template install step). Addedgitto the spin-setup stage.spin/spin.toml) —[component.fileserver.files]table is rejected by Spin v2 (filesmust be an array), and the pinned sha256 forspin_static_fs.wasmv0.3.0 didn't match the released artifact (verified independently via download + shasum). Runtime previously crash-looped./root/.cache/spin) was never copied into the runtime stages, so every boot re-downloaded the fileserver from GitHub (and failed offline).wasm-scratchadditionally COPY'd a nonexistent/root/.spin/cache, which failed the build. Both targets now build;spin-serververified serving with--network none.Docs corrected
nginx:1.27-alpine/ ~25 MB; the base is Debiannginx:1.27(~70 MB). Table, diagram, and comments updated.FROM …overlay pattern.STATIC_FILES_PATHmust point inside the Docker build context.Verification (published image + worktree builds, ports 18190-18199)
Location: https://…/healthreturnshealthySSL_DOMAIN=test.local→ CN/SAN test.local;SSL_CERT+SSL_KEYenv injection serves the provided certVary: Accept-Encoding; SPA fallback serves index for deep routes; all 6 security headers present on every responseindex.htmlbuilt via--build-arg STATIC_FILES_PATHand served over HTTPS🤖 Generated with Claude Code