From 14ab6982e9bef36ba1a36030b5a8869a562b84bb Mon Sep 17 00:00:00 2001 From: merge-check <140916359+agentHits@users.noreply.github.com> Date: Wed, 28 Oct 2026 12:24:00 -0400 Subject: [PATCH 1/3] fix(image): drop unused binaries, bump bundled tools, scan the image with Trivy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Что: - Образ панели ставит из apt-репозитория Docker только docker-ce-cli 29.9.2 с плагинами buildx и compose. Движок, containerd, runc, rootlesskit и docker-model, которые добавлял get.docker.com, убраны: панель работает с Docker хоста через сокет. - rclone 1.75.1 → 1.75.2, Railpack 0.40.1 → 0.42.0, pack 0.40.9 → 0.40.10. Docker Engine для серверов закреплён на 29.9.2. Версии поменяны во всех местах, которые сверяет component-versions-sync.test.ts: component-versions.ts, install-agenthits.sh, update.sh, Dockerfile, pull-request.yml, выбор Railpack в форме приложения. Таблица в docs/server-components-update.md обновлена. - Railpack 0.43.0 не взят: в нём ломающее изменение исключений в контексте сборки, а уязвимости закрыты те же, что в 0.42.0. - Миграция 0210: новые приложения получают railpackVersion 0.42.0 по умолчанию. Существующие приложения сохраняют свою версию. - Из рабочего node_modules удалён компилятор TypeScript 7 (Go-бинарник, 27 МБ). Его притягивают пакеты @trpc/* как обязательную peer-зависимость, а во время работы он не используется. - Из финального образа удалены npm, npx и node-gyp: панель запускается через node и bun. - Системные пакеты финальной стадии ставятся с --no-install-recommends. Нужные панели openssh-client, procps, xz-utils и netbase перечислены явно. Ушли systemd, dbus, iptables, apparmor и библиотеки X11. - Trivy 0.76.1, закреплённый по digest, сканирует образ, который собирает PR (bun-migration-docker-check.yml), и опубликованный agenthits-dev каждый понедельник (новый image-audit.yml). Проверка падает на critical и high, у которых есть исправление. - В .trivyignore.yaml три находки, которые есть даже в последних релизах buildx, compose, rclone и Railpack. У каждой срок до 2026-11-27. - Smoke-проверка образа в PR теперь вызывает все инструменты, которые панель запускает. - В CLAUDE.md описан аудит образа. Зачем: - bun audit видит только npm-зависимости. В образе agenthits-v1.0.8 Trivy нашёл 2 critical и 211 high, из них 89 high с исправлением: Go stdlib и golang.org/x/* в инструментах, undici и brace-expansion во встроенном npm, компилятор TypeScript. - В пробной сборке ОС с инструментами исправимых high стало 3 вместо 75. На весь образ ожидается 5, и все пять ждут релиза своего инструмента. - Находки в пакетах Debian 12 (2 critical, около 106 high) остаются. Debian не выпустил для них исправлений, и Debian 13 почти ничего не меняет, поэтому проверка их не учитывает (--ignore-unfixed). Риски: - Railpack 0.41–0.42 меняет поведение сборок: Java по умолчанию на Temurin, проверка подписи Node, кэш Turborepo. Существующие приложения сохраняют свою версию фронтенда, но план сборки строит бинарник 0.42.0 из образа. - Кнопка Components → Update предложит Docker 29.9.2, rclone 1.75.2, Railpack 0.42.0 и pack 0.40.10 на серверах. Обновление Docker перезапускает демон и сервисы swarm. - --no-install-recommends может убрать редкую утилиту, которую панель вызывает. Основные утилиты перечислены в smoke-проверке PR. - Новая уязвимость с исправлением остановит PR, который меняет образ, пока инструмент не обновят или не внесут находку в .trivyignore.yaml. Проверки: - Команды и результаты: Trivy 0.76.1 по agenthits-v1.0.8 — 2 C и 211 H, исправимых 89. Пробная сборка ОС с Docker CLI 29.9.2 из apt и без recommends — исправимых high 3. Новые бинарники rclone 1.75.2, Railpack 0.42.0, pack 0.40.10 и docker 29.9.2 — по 0–1 исправимой high. vitest component-versions-sync.test.ts — 26 из 26. biome check по изменённым TS-файлам — без замечаний. bash -n install-agenthits.sh update.sh — ок. actionlint по новым workflow — без замечаний. Панель из образа agenthits-dev со скрытыми TypeScript и npm запущена с Postgres 18.6 и Redis: миграции прошли, health 200, /register 200. Кода, который загружает typescript во время работы, в образе нет. - Ограничения: полный образ локально не собран: Bun падает под эмуляцией amd64 на arm64, а на диске Docker не хватило места для сборки arm64. Сборку amd64, вызов инструментов и скан выполняет CI этого PR. Миграция 0210 на живой базе не проверена. Сборка приложения через Railpack 0.42.0 не проверена. What: - The panel image installs only docker-ce-cli 29.9.2 with the buildx and compose plugins from Docker's apt repository. The engine, containerd, runc, rootlesskit and docker-model that get.docker.com added are gone: the panel drives the host's Docker through the socket. - rclone 1.75.1 → 1.75.2, Railpack 0.40.1 → 0.42.0, pack 0.40.9 → 0.40.10. Docker Engine for servers is pinned to 29.9.2. Versions changed everywhere component-versions-sync.test.ts compares: component-versions.ts, install-agenthits.sh, update.sh, Dockerfile, pull-request.yml, the Railpack picker of the application form. The table in docs/server-components-update.md is updated. - Railpack 0.43.0 is skipped: it changes build-context excludes in a breaking way and fixes the same advisories as 0.42.0. - Migration 0210: new applications default to railpackVersion 0.42.0. Existing applications keep their version. - The TypeScript 7 compiler (a 27 MB Go binary) is removed from the production node_modules. The @trpc/* packages pull it in as a required peer; nothing loads it at runtime. - npm, npx and node-gyp are removed from the final image: the panel runs on node and bun. - The final stage installs system packages with --no-install-recommends. openssh-client, procps, xz-utils and netbase, which the panel needs, are listed explicitly. systemd, dbus, iptables, apparmor and the X11 libraries are gone. - Trivy 0.76.1, pinned by digest, scans the image a PR builds (bun-migration-docker-check.yml) and the published agenthits-dev every Monday (new image-audit.yml). The check fails on critical and high findings that have a fix. - .trivyignore.yaml lists three findings that even the latest buildx, compose, rclone and Railpack releases carry. Each entry expires on 2026-11-27. - The PR image smoke now calls every tool the panel runs. - CLAUDE.md describes the image audit. Why: - bun audit sees only the npm dependencies. In agenthits-v1.0.8 Trivy found 2 critical and 211 high, 89 high with a fix: Go stdlib and golang.org/x/* in the tools, undici and brace-expansion in the bundled npm, the TypeScript compiler. - A probe build of the OS and tools went from 75 fixable high to 3. For the whole image 5 are expected, all waiting for a release of their tool. - Findings in Debian 12 packages (2 critical, about 106 high) remain. Debian has no fixes for them and Debian 13 barely differs, so the check leaves them out (--ignore-unfixed). Risks: - Railpack 0.41–0.42 changes build behaviour: Java defaults to Temurin, Node downloads are GPG-verified, Turborepo cache. Existing applications keep their frontend version, but the plan comes from the 0.42.0 binary in the image. - Components → Update will offer Docker 29.9.2, rclone 1.75.2, Railpack 0.42.0 and pack 0.40.10 on servers. A Docker update restarts the daemon and the swarm services. - --no-install-recommends may drop a rarely used utility the panel calls. The main ones are listed in the PR smoke. - A new fixable advisory stops a PR that changes the image until the tool is bumped or the finding goes into .trivyignore.yaml. Checks: - Commands and results: Trivy 0.76.1 on agenthits-v1.0.8 — 2 C and 211 H, 89 fixable. Probe build of the OS with Docker CLI 29.9.2 from apt and without recommends — 3 fixable high. New rclone 1.75.2, Railpack 0.42.0, pack 0.40.10 and docker 29.9.2 binaries — 0–1 fixable high each. vitest component-versions-sync.test.ts — 26 of 26. biome check on the changed TS files — clean. bash -n install-agenthits.sh update.sh — ok. actionlint on the new workflows — clean. The panel from the agenthits-dev image with TypeScript and npm hidden ran against Postgres 18.6 and Redis: migrations passed, health 200, /register 200. No code in the image loads typescript at runtime. - Limitations: the full image was not built locally: Bun crashes under amd64 emulation on arm64, and the Docker disk had no room for an arm64 build. The amd64 build, the tool calls and the scan run in this PR's CI. Migration 0210 was not run on a live database. An application build with Railpack 0.42.0 was not tried. Co-Authored-By: Claude Opus 5.5 --- .../workflows/bun-migration-docker-check.yml | 25 + .github/workflows/image-audit.yml | 44 + .github/workflows/pull-request.yml | 2 +- .trivyignore.yaml | 21 + CLAUDE.md | 1 + Dockerfile | 38 +- .../dashboard/application/build/show.tsx | 12 +- .../drizzle/0210_railpack_default_0_42_0.sql | 1 + apps/dokploy/drizzle/meta/0210_snapshot.json | 11165 ++++++++++++++++ apps/dokploy/drizzle/meta/_journal.json | 7 + docs/server-components-update.md | 10 +- install-agenthits.sh | 8 +- packages/server/src/db/schema/application.ts | 2 +- .../server/src/setup/component-versions.ts | 8 +- update.sh | 2 +- 15 files changed, 11318 insertions(+), 28 deletions(-) create mode 100644 .github/workflows/image-audit.yml create mode 100644 .trivyignore.yaml create mode 100644 apps/dokploy/drizzle/0210_railpack_default_0_42_0.sql create mode 100644 apps/dokploy/drizzle/meta/0210_snapshot.json diff --git a/.github/workflows/bun-migration-docker-check.yml b/.github/workflows/bun-migration-docker-check.yml index afadcce7aa9..0ad75f518a1 100644 --- a/.github/workflows/bun-migration-docker-check.yml +++ b/.github/workflows/bun-migration-docker-check.yml @@ -6,6 +6,7 @@ on: branches: [AgentHits-Dev] paths: - ".github/workflows/bun-migration-docker-check.yml" + - ".trivyignore.yaml" - "Dockerfile" - "Dockerfile.cloud" - "Dockerfile.server" @@ -58,6 +59,30 @@ jobs: test -f /app/packages/server/dist/index.js node --input-type=module -e "console.log(await import.meta.resolve(\"@dokploy/server\"))" ' + # The panel calls these at runtime; the image installs them without + # apt recommends and without the Docker engine. + docker run --rm --entrypoint sh dokploy-bun-check:main -ec ' + docker --version + docker buildx version + docker compose version + rclone version | head -n 1 + railpack --version + pack --version + nixpacks --version + git lfs version + ssh -V + for tool in ssh-keyscan pkill htpasswd rsync jq zip unzip ip tini; do command -v "$tool"; done + ' + + # Same scan as image-audit.yml, on the image this PR builds. + - name: Scan main image + env: + TRIVY_IMAGE: aquasec/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c + run: | + docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/src:ro" -w /src "$TRIVY_IMAGE" image \ + --image-src docker --scanners vuln --severity CRITICAL,HIGH \ + --ignore-unfixed --ignorefile .trivyignore.yaml --exit-code 1 \ + --no-progress dokploy-bun-check:main service-image-builds: runs-on: ubuntu-24.04 diff --git a/.github/workflows/image-audit.yml b/.github/workflows/image-audit.yml new file mode 100644 index 00000000000..9fe2bde2273 --- /dev/null +++ b/.github/workflows/image-audit.yml @@ -0,0 +1,44 @@ +name: Image audit + +# bun audit sees only the npm dependencies. This scan reads the published panel +# image: its Debian packages, the Go binaries of the bundled tools (Docker CLI, +# rclone, Railpack, pack) and the npm packages inside it. It fails on critical +# and high findings that already have a fix; .trivyignore.yaml lists the ones +# still waiting for a tool release. GitHub notifies the person who last changed +# the cron line when a scheduled run fails. +on: + schedule: + - cron: "53 5 * * 1" + workflow_dispatch: + inputs: + image: + description: Image to scan + type: string + default: ghcr.io/agenthits/dokploy:agenthits-dev + +permissions: + contents: read + +env: + # Pinned by digest: in March 2026 Trivy releases, its images and the + # trivy-action tags were replaced with credential stealers (GHSA-69fq-xp46-6x23). + # bun-migration-docker-check.yml pins the same image. + TRIVY_IMAGE: aquasec/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c + +jobs: + scan: + name: image audit + runs-on: ubuntu-24.04 + timeout-minutes: 20 + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Scan image + env: + IMAGE: ${{ inputs.image || 'ghcr.io/agenthits/dokploy:agenthits-dev' }} + run: | + docker run --rm -v "$PWD:/src:ro" -w /src "$TRIVY_IMAGE" image \ + --image-src remote --scanners vuln --severity CRITICAL,HIGH \ + --ignore-unfixed --ignorefile .trivyignore.yaml --exit-code 1 \ + --no-progress "$IMAGE" diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index d7b2aaeb4df..0f22830e8da 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -68,7 +68,7 @@ jobs: - name: Install Railpack if: matrix.job == 'test' && runner.environment == 'github-hosted' run: | - export RAILPACK_VERSION=0.40.1 + export RAILPACK_VERSION=0.42.0 curl -sSL https://railpack.com/install.sh | bash echo "Railpack installed $RAILPACK_VERSION" diff --git a/.trivyignore.yaml b/.trivyignore.yaml new file mode 100644 index 00000000000..f38e7226d8f --- /dev/null +++ b/.trivyignore.yaml @@ -0,0 +1,21 @@ +# Fixable findings in bundled tools whose latest release still carries them. +# Each entry expires, so the image audit fails again and the tool gets checked +# for a new release. +vulnerabilities: + - id: CVE-2026-111943 + paths: + - usr/bin/rclone + - usr/local/bin/railpack + statement: rclone 1.75.2 and Railpack 0.42.0 are built with Go 1.26.9; the fix needs Go 1.26.10. + expired_at: 2026-11-27 + - id: CVE-2026-78669 + paths: + - usr/libexec/docker/cli-plugins/docker-buildx + - usr/libexec/docker/cli-plugins/docker-compose + statement: buildx 0.38.1 and compose 5.6.1, the latest releases, use golang.org/x/net below 0.60.0. + expired_at: 2026-11-27 + - id: CVE-2026-17106 + paths: + - usr/libexec/docker/cli-plugins/docker-buildx + statement: buildx 0.38.1, the latest release, uses moby/go-archive 0.2.0. + expired_at: 2026-11-27 diff --git a/CLAUDE.md b/CLAUDE.md index b6a2ac7598c..87744d8a956 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -27,3 +27,4 @@ One GitHub release `agenthits-vX.Y.Z` covers a batch of work, not a single PR (o - The one-day age is `minimumReleaseAge` in `bunfig.toml` and `MIN_RELEASE_AGE` in the workflow; change both together. - A commit pushed to the branch of the open PR stops its daily rebuild until the PR is merged or closed. - `.github/workflows/dependency-audit.yml` runs `bun audit` every Monday for advisories published between updates. +- `bun audit` does not see the image. Trivy scans the published `agenthits-dev` image every Monday (`.github/workflows/image-audit.yml`) and the image a PR builds (`bun-migration-docker-check.yml`). Both fail on critical and high findings that have a fix in Debian packages, in the Go binaries of the bundled tools (Docker CLI, rclone, Railpack, pack) or in npm packages inside the image. `.trivyignore.yaml` holds findings whose latest tool release still carries them; each entry expires, so the audit fails again and the tool gets rechecked. Trivy is pinned by digest in both workflows; move them together. diff --git a/Dockerfile b/Dockerfile index 1ca88dde2f7..52ea42ac3d3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -25,10 +25,14 @@ COPY packages/server/package.json ./packages/server/package.json # build-stage install kept Bun's isolated store (node_modules/.bun, 1.6 GB) in # the image, and packages/server resolved its imports through that store, so # the panel loaded every shared dependency into memory twice. +# +# The @trpc packages list typescript as a required peer, so the production +# install also brings the TypeScript 7 compiler, a Go binary the panel never runs. FROM deps AS prod-deps RUN --mount=type=cache,id=bun,target=/root/.bun/install/cache \ bun install --production --frozen-lockfile --linker hoisted \ && rm -f node_modules/dokploy node_modules/@dokploy/api node_modules/@dokploy/schedules \ + && rm -rf node_modules/typescript node_modules/@typescript node_modules/.bin/tsc \ && mkdir -p packages/server/node_modules FROM deps AS build @@ -61,7 +65,18 @@ ENV NODE_ENV=production ENV DOKPLOY_OFFICIAL_VERSION=$DOKPLOY_OFFICIAL_VERSION ENV DOKPLOY_FORK_VERSION=$DOKPLOY_FORK_VERSION -RUN apt-get update && apt-get install -y tini curl unzip zip apache2-utils iproute2 rsync jq git-lfs && git lfs install && rm -rf /var/lib/apt/lists/* +# Recommends would add systemd, dbus and X11 libraries; the packages the panel +# calls are listed instead: openssh-client for git over SSH and ssh-keyscan, +# procps for pkill when a deployment is cancelled. +RUN apt-get update \ + && apt-get install -y --no-install-recommends tini curl unzip zip apache2-utils iproute2 rsync jq git-lfs openssh-client procps xz-utils netbase \ + && git lfs install \ + && rm -rf /var/lib/apt/lists/* + +# The panel runs on node and bun. npm, npx and node-gyp only serve the build +# stages, and npm ships its own copies of packages with open advisories. +RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/node-gyp \ + /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/node-gyp # Copy only the necessary files COPY --from=build /usr/src/app/apps/dokploy/.next ./.next @@ -78,12 +93,21 @@ COPY --from=build /usr/src/app/packages/server/package.json ./packages/server/pa COPY --from=build /usr/src/app/packages/server/dist ./packages/server/dist -# Install docker -ARG DOCKER_VERSION=29.8.2 -RUN curl -fsSL https://get.docker.com -o get-docker.sh && sh get-docker.sh --version "$DOCKER_VERSION" && rm get-docker.sh +# The panel drives the host's Docker daemon through the mounted socket, so it +# needs only the CLI and its buildx and compose plugins. get.docker.com would +# also install the engine, containerd and the rootless extras: unused binaries +# that scanners report. +ARG DOCKER_VERSION=29.9.2 +RUN . /etc/os-release \ + && install -m 0755 -d /etc/apt/keyrings \ + && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \ + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends "docker-ce-cli=5:${DOCKER_VERSION}-1~debian.${VERSION_ID}~${VERSION_CODENAME}" docker-buildx-plugin docker-compose-plugin \ + && rm -rf /var/lib/apt/lists/* # Install rclone -ARG RCLONE_VERSION=1.75.1 +ARG RCLONE_VERSION=1.75.2 RUN apt-get update \ && apt-get install -y --no-install-recommends unzip \ && curl -fsSL "https://downloads.rclone.org/v${RCLONE_VERSION}/rclone-v${RCLONE_VERSION}-linux-amd64.zip" -o /tmp/rclone.zip \ @@ -102,12 +126,12 @@ RUN curl -sSL https://nixpacks.com/install.sh -o install.sh \ && bun install -g tsx # Install Railpack -ARG RAILPACK_VERSION=0.40.1 +ARG RAILPACK_VERSION=0.42.0 RUN curl -sSL https://railpack.com/install.sh \ | RAILPACK_VERSION="$RAILPACK_VERSION" bash -s -- --yes --bin-dir /usr/local/bin # Install buildpacks -COPY --from=buildpacksio/pack:0.40.9 /usr/local/bin/pack /usr/local/bin/pack +COPY --from=buildpacksio/pack:0.40.10 /usr/local/bin/pack /usr/local/bin/pack EXPOSE 3000 diff --git a/apps/dokploy/components/dashboard/application/build/show.tsx b/apps/dokploy/components/dashboard/application/build/show.tsx index 6fb90312436..7f301990dc9 100644 --- a/apps/dokploy/components/dashboard/application/build/show.tsx +++ b/apps/dokploy/components/dashboard/application/build/show.tsx @@ -31,6 +31,8 @@ import { api } from "@/utils/api"; // Railpack versions from https://github.com/railwayapp/railpack/releases export const RAILPACK_VERSIONS = [ + "0.42.0", + "0.41.0", "0.40.1", "0.39.0", "0.38.0", @@ -142,7 +144,7 @@ const mySchema = z.discriminatedUnion("buildType", [ }), z.object({ buildType: z.literal(BuildType.railpack), - railpackVersion: z.string().nullable().default("0.40.1"), + railpackVersion: z.string().nullable().default("0.42.0"), }), z.object({ buildType: z.literal(BuildType.static), @@ -283,7 +285,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => { : null, railpackVersion: data.buildType === BuildType.railpack - ? data.railpackVersion || "0.40.1" + ? data.railpackVersion || "0.42.0" : null, }) .then(async () => { @@ -545,7 +547,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => { size="sm" onClick={() => { setIsManualRailpackVersion(false); - field.onChange("0.40.1"); + field.onChange("0.42.0"); }} > Use predefined versions @@ -561,7 +563,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => { field.onChange(value); } }} - value={field.value ?? "0.40.1"} + value={field.value ?? "0.42.0"} > @@ -575,7 +577,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => { {RAILPACK_VERSIONS.map((version) => ( v{version} - {version === "0.40.1" && ( + {version === "0.42.0" && ( /dev/null 2>&1 From a8304e0c0a62c022713b7a85a4b3bed6de2f0834 Mon Sep 17 00:00:00 2001 From: merge-check <140916359+agentHits@users.noreply.github.com> Date: Wed, 28 Oct 2026 12:42:54 -0400 Subject: [PATCH 2/3] test(server-components): take the Docker version from the pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Что: - server-components.test.ts берёт версию Docker из PINNED_VERSIONS.docker: в поддельном выводе apt-cache madison, в FAKE_TARGET_ENGINE, в DOCKER_NEW и в двух ожидаемых сообщениях «Docker not updated». Зачем: - 18 тестов держали 29.8.2 строкой и упали в pr-check (test) после перехода на 29.9.2. Следующее обновление Docker их больше не сломает. Риски: - не выявлены. Проверки: - Команды и результаты: vitest server-components.test.ts, install-agenthits-update.test.ts, component-versions-sync.test.ts, railpack.command.test.ts — 177 из 177; biome check — без замечаний. - Ограничения: полный набор тестов прогонит CI. What: - server-components.test.ts takes the Docker version from PINNED_VERSIONS.docker: in the fake apt-cache madison output, in FAKE_TARGET_ENGINE, in DOCKER_NEW and in the two expected "Docker not updated" messages. Why: - 18 tests held 29.8.2 as a literal and failed in pr-check (test) after the move to 29.9.2. The next Docker bump will not break them. Risks: - none identified. Checks: - Commands and results: vitest server-components.test.ts, install-agenthits-update.test.ts, component-versions-sync.test.ts, railpack.command.test.ts — 177 of 177; biome check — clean. - Limitations: CI runs the full suite. Co-Authored-By: Claude Opus 5.5 --- apps/dokploy/__test__/server/server-components.test.ts | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/apps/dokploy/__test__/server/server-components.test.ts b/apps/dokploy/__test__/server/server-components.test.ts index f80885d8d7b..af4794dbc27 100644 --- a/apps/dokploy/__test__/server/server-components.test.ts +++ b/apps/dokploy/__test__/server/server-components.test.ts @@ -517,7 +517,7 @@ case "$1" in if [ "$FAKE_CANDIDATE_AFTER_REPO" = 1 ] && [ ! -f "$DOKPLOY_APT_SOURCES_DIR/docker.list" ]; then exit 0 fi - echo " docker-ce | 5:29.8.2-1~ubuntu.24.04~noble | https://download.docker.com/linux/ubuntu noble/stable amd64 Packages" + echo " docker-ce | 5:${PINNED_VERSIONS.docker}-1~ubuntu.24.04~noble | https://download.docker.com/linux/ubuntu noble/stable amd64 Packages" ;; policy) case "$2" in @@ -726,7 +726,7 @@ const runComponentScript = ( CALL_LOG: callLog, FAKE_STATE: dir, FAKE_PREVIOUS_ENGINE: "28.3.0", - FAKE_TARGET_ENGINE: "29.8.2", + FAKE_TARGET_ENGINE: PINNED_VERSIONS.docker, FAKE_OLD_IMAGE: "traefik:v3.6.25", TMPDIR: dir, TRAEFIK_SETTLE_SECONDS: "0", @@ -763,7 +763,7 @@ const runComponentScript = ( const SPAWN_TEST_TIMEOUT_MS = 30_000; const DOCKER_OLD = "5:28.3.0-1~ubuntu.24.04~noble"; -const DOCKER_NEW = "5:29.8.2-1~ubuntu.24.04~noble"; +const DOCKER_NEW = `5:${PINNED_VERSIONS.docker}-1~ubuntu.24.04~noble`; const HTTP_CHALLENGE_CONFIG = "certificatesResolvers:\n letsencrypt:\n acme:\n email: admin@example.com\n httpChallenge:\n entryPoint: web\n"; const TLS_CHALLENGE_CONFIG = @@ -1413,7 +1413,7 @@ describe("buildComponentUpdateScript run order", { timeout: 60_000 }, () => { expect(run.status).toBe(0); expect(run.stdout).toContain( - "Docker not updated: Docker 29.8.2 is not offered by the Docker apt repository configured on this host.", + `Docker not updated: Docker ${PINNED_VERSIONS.docker} is not offered by the Docker apt repository configured on this host.`, ); expect(run.stdout).toContain( `Traefik version ${TRAEFIK_VERSION} installed`, @@ -1499,7 +1499,7 @@ describe("buildComponentUpdateScript run order", { timeout: 60_000 }, () => { expect(run.status).toBe(0); expect(run.stdout).toContain( - "Docker not updated: Docker 29.8.2 is not in the apt sources, even after adding Docker's repository. The other components continue.", + `Docker not updated: Docker ${PINNED_VERSIONS.docker} is not in the apt sources, even after adding Docker's repository. The other components continue.`, ); expect(run.stdout).toContain( `Traefik version ${TRAEFIK_VERSION} installed`, From c6806796f1db61f8a150c198848d57e4d2905adc Mon Sep 17 00:00:00 2001 From: merge-check <140916359+agentHits@users.noreply.github.com> Date: Wed, 28 Oct 2026 12:44:19 -0400 Subject: [PATCH 3/3] ci(image): build a sample app with the image's Railpack MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Что: - main-image-smoke изнутри образа панели повторяет путь, которым панель собирает приложения через Railpack: railpack prepare, затем docker buildx с фронтендом Railpack на builder с драйвером docker-container. Собирается минимальное Node-приложение, затем оно запускается и отвечает на HTTP. - Ручной запуск принимает railpack-frontend: так можно проверить фронтенд, который сохраняют существующие приложения (например 0.40.1), с планом от нового бинарника. Зачем: - Обновление Railpack, которое не может собрать простое приложение, теперь ловится в PR, а не после выкатки. Риски: - Шаг добавляет около минуты и скачивает образы сборщика Railpack в PR, которые меняют образ. Проверки: - Команды и результаты: actionlint — без замечаний. Сам шаг проверяется в CI этого PR. - Ограничения: локально не запускался: на диске Docker нет места. What: - main-image-smoke repeats, from inside the panel image, the path the panel uses to build Railpack applications: railpack prepare, then docker buildx with the Railpack frontend on a docker-container builder. It builds a minimal Node app, then runs it and expects an HTTP answer. - A manual run takes railpack-frontend, to check a frontend existing applications keep (e.g. 0.40.1) with a plan from the new binary. Why: - A Railpack bump that cannot build a plain app now fails in the PR instead of after a rollout. Risks: - The step adds about a minute and pulls the Railpack builder images in PRs that change the image. Checks: - Commands and results: actionlint — clean. The step itself is checked by this PR's CI. - Limitations: not run locally: the Docker disk has no room. Co-Authored-By: Claude Opus 5.5 --- .../workflows/bun-migration-docker-check.yml | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/.github/workflows/bun-migration-docker-check.yml b/.github/workflows/bun-migration-docker-check.yml index 0ad75f518a1..9aeaa11cfc2 100644 --- a/.github/workflows/bun-migration-docker-check.yml +++ b/.github/workflows/bun-migration-docker-check.yml @@ -2,6 +2,11 @@ name: Bun Migration Docker Check on: workflow_dispatch: + inputs: + railpack-frontend: + description: "Railpack frontend for the sample app build, e.g. a version existing applications keep (empty: the image's Railpack version)" + type: string + default: "" pull_request: branches: [AgentHits-Dev] paths: @@ -74,6 +79,33 @@ jobs: for tool in ssh-keyscan pkill htpasswd rsync jq zip unzip ip tini; do command -v "$tool"; done ' + # Repeats the panel's Railpack path (railpack prepare, then buildx with the + # Railpack frontend on a docker-container builder) from inside the image, + # so a Railpack bump that cannot build a plain Node app fails here. + - name: Build a sample app with Railpack + env: + RAILPACK_FRONTEND: ${{ inputs.railpack-frontend }} + run: | + app="$RUNNER_TEMP/railpack-app" + mkdir -p "$app" + printf '%s\n' '{"name":"railpack-smoke","private":true,"scripts":{"start":"node index.js"}}' > "$app/package.json" + printf '%s\n' 'require("node:http").createServer((_, res) => res.end("railpack-ok")).listen(process.env.PORT || 3000);' > "$app/index.js" + frontend="${RAILPACK_FRONTEND:-$(docker run --rm --entrypoint railpack dokploy-bun-check:main --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n 1)}" + echo "Railpack frontend: $frontend" + docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$app:/src" -e FRONTEND="$frontend" --entrypoint sh dokploy-bun-check:main -ec ' + railpack prepare /src --plan-out /src/railpack-plan.json --info-out /src/railpack-info.json + docker buildx create --name railpack-smoke --driver docker-container + docker buildx build --builder railpack-smoke --build-arg "BUILDKIT_SYNTAX=ghcr.io/railwayapp/railpack-frontend:v$FRONTEND" -f /src/railpack-plan.json --output type=docker,name=railpack-smoke /src + docker buildx rm railpack-smoke + ' + docker run -d --name railpack-smoke -e PORT=3000 -p 127.0.0.1:3999:3000 railpack-smoke + for _ in $(seq 1 30); do + if [ "$(curl -fs http://127.0.0.1:3999 || true)" = railpack-ok ]; then exit 0; fi + sleep 1 + done + docker logs railpack-smoke + exit 1 + # Same scan as image-audit.yml, on the image this PR builds. - name: Scan main image env: