Repository navigation
feat(infra): production container for the API, worker, beat and migrations - #73
Merged
Merged
Conversation
…tions One multi-stage image (services/api/Dockerfile, built from the repo root): locked runtime dependencies installed by uv, a slim non-root runtime with Debian security updates applied, a HEALTHCHECK on /health, and an entrypoint whose first argument picks the role (api, worker, beat, migrate). The migrate role prefers MIGRATION_DATABASE_URL so only the release step holds owner credentials. CI gains an image job: build with layer caching, start the container and require /health plus a healthy Docker status as a non-root user, then fail on fixable HIGH/CRITICAL vulnerabilities (Trivy 0.75.0). docker-compose gets an app profile that runs all three processes from the image. The deploy runbook documents the service layout. Verified locally: each role starts (worker connects to Redis and reports ready; beat schedules; migrate applies via the override and fails without it); Trivy finds no fixable HIGH/CRITICAL issues. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One multi-stage image (services/api/Dockerfile, built from the repo root): locked runtime dependencies installed by uv, a slim non-root runtime with Debian security updates applied, a HEALTHCHECK on /health, and an entrypoint whose first argument picks the role (api, worker, beat, migrate). The migrate role prefers MIGRATION_DATABASE_URL so only the release step holds owner credentials.
CI gains an image job: build with layer caching, start the container and require /health plus a healthy Docker status as a non-root user, then fail on fixable HIGH/CRITICAL vulnerabilities (Trivy 0.75.0). docker-compose gets an app profile that runs all three processes from the image. The deploy runbook documents the service layout.
Verified locally: each role starts (worker connects to Redis and reports ready; beat schedules; migrate applies via the override and fails without it); Trivy finds no fixable HIGH/CRITICAL issues.