feat(webapp,cli): let self-hosted instances require deploy base images - #5005
brentshulman-silkline wants to merge 1 commit into
Conversation
Adds DEPLOY_BASE_IMAGES / DEPLOY_BUILD_BASE_IMAGES (runtime=image csv) to the webapp. The deployment initialize response carries the images for the deploy's runtime, and the CLI rewrites the Containerfile to build on them.
🦋 Changeset detectedLatest commit: 5d3fb37 The changes in this PR will be included in the next version bump. This PR includes changesets to release 28 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WalkthroughThe webapp now accepts per-runtime deploy and build image settings and returns matching images in the deployment response. The CLI uses returned images when rewriting the Containerfile and retains runtime defaults for image fields that are not configured. The changes also add schema and test coverage, self-hosting documentation, and release notes. Priority: ⬇️ Low Merge Risk: 🟡 Moderate · up to Self-hosted operators who configure custom base images may still get published images in two cases: projects that use image instructions, and bundle-based deploys. That weakens the guarantee regulated self-hosters rely on. The Bun documentation also understates what a custom image must provide. Instances without the new settings are unaffected. Resolve these gaps or explicitly accept them before merging. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to Configured image requirements are not enforced consistently across deployment paths. The normal deployment path honors the runtime base image, but bundle builds and existing-deployment attachment can omit it, and project instructions can override the selected build-stage image. Exposure is limited to authenticated deployers on configured instances; existing environment authorization remains intact. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
Full details: Linked Issues checkExplanation [ Full details: Docstring CoverageExplanation Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 6 functions across 10 files. (3 skipped: 3 unsupported.)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Repository UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
8a8f7cfd-ad56-4ebe-907c-ac14d41a7679
📒 Files selected for processing (13)
.changeset/instance-deploy-base-images.mdapps/webapp/app/env.server.tsapps/webapp/app/routes/api.v1.deployments.tsapps/webapp/app/v3/deployBaseImages.server.tsapps/webapp/test/deployBaseImages.test.tsdocs/self-hosting/env/webapp.mdxdocs/self-hosting/overview.mdxpackages/cli-v3/src/build/buildWorker.tspackages/cli-v3/src/commands/deploy.tspackages/cli-v3/src/deploy/buildImage.test.tspackages/cli-v3/src/deploy/buildImage.tspackages/core/src/v3/schemas/api.tspackages/core/src/v3/schemas/build.ts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.
📜 Review details
🧰 Additional context used
📚 Code guidelines (1)
.cursor/rules/webapp.mdc — auto-discovered
📓 Path-based instructions (1)
Source excerpt: In the webapp, all environment variables are accessed through the `env` export of [env.server.ts](mdc:apps/webapp/app/env.server.ts), instead of directly accessing `process.env`.
📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)
Files:
apps/webapp/app/routes/api.v1.deployments.tsapps/webapp/test/deployBaseImages.test.tsapps/webapp/app/env.server.tsapps/webapp/app/v3/deployBaseImages.server.ts
🧠 Learnings (2)
📚 Learning: 2026-06-16T09:19:47.637Z
Learnt from: d-cs
Repo: triggerdotdev/trigger.dev PR: 3960
File: apps/webapp/test/prismaInfrastructureErrorCapture.test.ts:0-0
Timestamp: 2026-06-16T09:19:47.637Z
Learning: In this repo’s Vitest setup, `vitest.config.ts` uses `globals: true`, so identifiers like `vi`, `describe`, `it`, and `expect` are available as globals in Vitest test files. During code review, do not flag missing `vi`/`describe`/`it`/`expect` imports as a runtime error or correctness issue when they’re used in `*.test.ts/tsx` or `*.spec.ts/tsx` files. Explicit imports are still preferred for consistency, but they’re not required for runtime behavior.
Applied to files:
apps/webapp/test/deployBaseImages.test.ts
📚 Learning: 2026-05-20T17:21:18.543Z
Learnt from: d-cs
Repo: triggerdotdev/trigger.dev PR: 3678
File: apps/webapp/app/entry.server.tsx:0-0
Timestamp: 2026-05-20T17:21:18.543Z
Learning: In env.server.ts (Zod env schema), any environment variable you plan to access via the typed `env` export (e.g., `env.SENTRY_DSN`) must be explicitly declared in the schema. For `SENTRY_DSN`, include `SENTRY_DSN: z.string().optional()`; otherwise switching from `process.env.SENTRY_DSN` to `env.SENTRY_DSN` will fail TypeScript typechecking.
Applied to files:
apps/webapp/app/env.server.ts
🪛 LanguageTool
docs/self-hosting/overview.mdx
[grammar] ~105-~105: Ensure spelling is correct
Context: ... image, set DEPLOY_BASE_IMAGES on the webapp (and optionally `DEPLOY_BUILD_BASE_IMAG...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
| - `node` (or `bun`) on `PATH` at the runtime's major version | ||
| - `busybox`, `ca-certificates`, `dumb-init`, `git` and `openssl` | ||
| - a `node` user |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the requirements for a custom Bun base. A Bun image also needs node on PATH: the generated final stage runs dumb-init node. It needs a bun user: the generated build and final stages specify USER bun. An image that provides only the documented bun executable and node user can fail to build or start. State the Node and Bun requirements separately. (docs.docker.com)
|
|
||
| warnAboutCanceledDeployments(deployment.canceledDeployments, options.externalId); | ||
|
|
||
| if (deployment.baseImages) { |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Apply the image override to fresh bundle deploys. If a deploy uses --from-bundle, _deployCommand returns before this rewrite. handleFromBundleDeploy then initializes the deployment and builds the supplied bundle without using its baseImages. On an instance with an override, that CLI path does not build from the configured image. Apply the override to the bundle’s Containerfile before buildAndFinalizeFromBundle.
| apt-get clean && \\ | ||
| rm -rf /var/lib/apt/lists/*` | ||
| : `FROM ${BUILD_IMAGE[options.runtime]} AS build | ||
| : `FROM ${options.image?.buildBase ?? BUILD_IMAGE[options.runtime]} AS build |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Honor buildBase when image instructions are present. If image.instructions is nonempty, the other branch generates FROM base AS build. It never reads the operator’s buildBase, even when DEPLOY_BUILD_BASE_IMAGES matches the runtime. This defeats the configured build-stage image for projects with instructions. Make the instructions path use the configured build base, or reject this combination with a clear error. (docs.docker.com)
This branch has not been deployed
1 participant
Closes #5004
Lets a self-hosted operator require custom base images for every deploy to their instance, such as FIPS-validated or hardened Node images. Cloud never sets the new variables, so Cloud users see no new option. This is the instance-level alternative to the per-project config in #5003.
What changes
runtime=imagecsv in the same style asDEPLOY_REGISTRY_ECR_TAGS.resolveDeployBaseImages()picks the images for the deployment's runtime.POST /api/v1/deploymentsreturns them asbaseImageson newly created deployments.@trigger.dev/core:InitializeDeploymentResponseBody.baseImages.BuildManifest.image.{base,buildBase}.baseImages,deployrewrites the Containerfile with them.generateContainerfilefalls back toBASE_IMAGE/BUILD_IMAGEwhen the images are unset.self-hosting/env/webapp.self-hosting/overviewthat lists what a base must provide, with a warning that apt-based extensions assume Debian.Open questions
buildWorker, before the deployment exists, so the CLI rewrites it after init. Would you rather move initialization ahead of the build?deploypath only. Should the--from-bundle/ native build server paths honorbaseImagestoo, or are those Cloud-only?image.instructions, the build stage still runsFROM baseplus anapt-gettoolchain install, which fails on non-Debian bases. ShouldbuildBasecover that case too?✅ Checklist
Testing
packages/cli-v3:vitest run src/deploy src/build(9 files, 128 tests) andtypecheckpass. NewgenerateContainerfiletests cover base and build overrides on node and bun, and a base-only override.apps/webapp: the newtest/deployBaseImages.test.tspasses (5 tests: runtime selection, missing runtime or entry, malformed csv).typecheckreports no errors in the changed files. Its error count is identical with and without this change on my partial local install.oxfmtis clean on the changed files.Changelog
Self-hosted instances can require custom base images for deploys, such as FIPS-validated or hardened Node images, with the new
DEPLOY_BASE_IMAGESwebapp setting.Screenshots
N/A
💯