osobh/clawmates
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

server-image: switch base to debian:12-slim + install git
ci / gates (push) Successful in 5s
Details
ci / frontend (push) Successful in 26s
Details
ci / rust (push) Successful in 4m3s
Details
ci / e2e (push) Has been skipped
Details
ci / publish (push) Successful in 2m46s
Details

Browse Source 
Distroless static-debian12 has no git binary, so
routes/research_setup::ensure_repo_workspace's `tokio::process::Command::new("git")`
returned "No such file or directory" for every wizard-materialized
research topic. Silent failure — the topic's repo_workspace_path
stayed NULL, prepare_topic_runtime bailed out, the run was enqueued
against the shared workspace-wide gateway which then 401'd or timed
out on cold auth.

Switching to debian:12-slim + apt-installing git + ca-certificates
(needed by clone-over-https). Same UID 65532 as before so bind-mount
hosts don't need re-chown.

Image size grows from ~40MB to ~80-100MB but this is the correct
base for a service that shells out to git. Static distroless was a
premature optimization once the server's job description grew a
"clone repos" responsibility.

Follow-up: research migrating to the `gix` pure-Rust crate so we can
go back to distroless. Nontrivial refactor of ensure_repo_workspace
so not attempted in this fix.
This commit is contained in:
Omar Sobh
2026-07-10 11:23:55 -07:00
parent 2df9dd04df
commit 8417f6e65c
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
images/server.Dockerfile
+12 -2
View File
@@ -32,7 +32,17 @@ ENV CARGO_NET_GIT_FETCH_WITH_CLI=true \
RUN cargo build --release --target "$(cat /rust-target)" -p clawmates-server \ RUN cargo build --release --target "$(cat /rust-target)" -p clawmates-server \
&& cp "target/$(cat /rust-target)/release/clawmates-server" /clawmates-server && cp "target/$(cat /rust-target)/release/clawmates-server" /clawmates-server
FROM gcr.io/distroless/static-debian12:nonroot FROM debian:12-slim
# git — required at runtime for research topic repo clones
# (routes/research_setup::ensure_repo_workspace shells out to `git clone`
# and `git ls-files`). The distroless variant we had here didn't include
# a git binary; every wizard-materialized research topic silently failed
# to clone until this change.
# ca-certificates — required by `git clone` over HTTPS.
RUN apt-get update \
&& apt-get install -y --no-install-recommends git ca-certificates \
&& rm -rf /var/lib/apt/lists/* \
&& useradd -u 65532 -M -s /usr/sbin/nologin nonroot
COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server COPY --from=builder /clawmates-server /usr/local/bin/clawmates-server
USER nonroot USER 65532
ENTRYPOINT ["/usr/local/bin/clawmates-server"] ENTRYPOINT ["/usr/local/bin/clawmates-server"]