Skip to content

dev2: REMOTE_BUILD=c0mpute builds site images on a c0mpute builder - #263

Merged
ralyodio merged 1 commit into
masterfrom
feat/dev2-remote-build-c0mpute
Nov 11, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/dev2-remote-build-c0mpute

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Opt-in REMOTE_BUILD=c0mpute for dev2 deploy-app.sh: build each service's image on a c0mpute builder (container.run, profullstack/c0mpute#318, DIP 0033) instead of on dev2, whose disk build scratch keeps filling.

  • Context = git archive of the build context at the deployed sha (the job takes a plain tarball, no git). Dockerfile/target/build args come from docker compose config (only the public values the script already exports).
  • c0mpute build --load -t <compose image>, then the unchanged standby / up / health / rollback.
  • Remote failure stops before touching the running stack; REMOTE_BUILD_FALLBACK=local opts into a local build instead.
  • dev2-site writes REMOTE_BUILD, C0MPUTE_BUILDERS, REMOTE_BUILD_FALLBACK from sites.d remote_build, remote_builders, remote_build_fallback.
  • Enabled for c0mpute.com and threatcrush.com (builder: vienna).

🤖 Generated with Claude Code

deploy-app.sh gets an opt-in remote build: with REMOTE_BUILD=c0mpute in
deploy.env it git-archives each build service's context at the deployed sha,
passes the Dockerfile, target and build args compose resolved (the exported
public NEXT_PUBLIC_*-style values), runs `c0mpute build --load -t <image>`
on the builders in C0MPUTE_BUILDERS, then the usual standby / up / health /
rollback. A failed remote build stops before the running stack is touched
(REMOTE_BUILD_FALLBACK=local builds here instead). dev2-site writes the
variables from sites.d remote_build / remote_builders / remote_build_fallback.

On for c0mpute.com and threatcrush.com, building on vienna (node AmaKBdpB),
to keep build scratch off dev2's full disk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1099
HIGH py-ssrf-outbound-request dev2/dev2-site:1909
HIGH sh-remote-script-execution root-ubuntu.sh:3262
HIGH sh-remote-script-execution root-ubuntu.sh:3263
HIGH sh-remote-script-execution root-ubuntu.sh:5168
HIGH sh-remote-script-execution root-ubuntu.sh:5172
HIGH sh-remote-script-execution root-w3bs-os.sh:3639
HIGH sh-remote-script-execution root-w3bs-os.sh:3640
HIGH sh-remote-script-execution root-w3bs-os.sh:5569
HIGH sh-remote-script-execution root-w3bs-os.sh:5579
HIGH sh-remote-script-execution root-w3bs-os.sh:5586
HIGH sh-remote-script-execution root-w3bs-os.sh:5602
HIGH sh-remote-script-execution root-w3bs-os.sh:5607
HIGH sh-plaintext-download root-w3bs-os.sh:6289
MEDIUM sql-template-interpolation dev2/dev2-site:1340
MEDIUM sql-template-interpolation dev2/dev2-site:1417
MEDIUM sh-remote-script-execution root-ubuntu.sh:5376
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1060
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:41
LOW secret-generic-credential src/credentials.ts:58
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/credentials.ts:66
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit e0417a4 into master Nov 11, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant