fix(container): repair Containerfile build rot + runtime.exs env config#273
Merged
hyperpolymath merged 3 commits intoJul 9, 2026
Merged
Conversation
…env config The container/Containerfile build was broken end-to-end; six fixes make `podman build -f container/Containerfile` succeed and produce a runnable REST image: 1. .dockerignore excluded scripts/fetch-cartridges.sh (needed by COPY) and schemas/cartridge-v1.json (Catalog schema mirror) — un-ignored both. 2. Pin Zig to 0.15.1 (.tool-versions) instead of unpinned `apk add zig`, which pulled a newer Zig that removed std.heap.GeneralPurposeAllocator. 3. Elixir builder cgr.dev/chainguard/elixir:latest is now 403/auth-gated → public docker.io/elixir:1.18.4-otp-25. 4. Runtime base cgr.dev/chainguard/wolfi-base lost gcompat/ncurses-libs and its OpenSSL 3 breaks the OTP-25 crypto NIF (needs libcrypto.so.1.1) → debian:bullseye-slim (matches builder ABI). 5. COPY schemas/cartridge-v1.json into /schemas (Catalog requires it at boot). 6. Strip multi-GB .zig-cache from the cartridge tree before the runtime COPY (was exhausting build disk). Plus config/runtime.exs so BOJ_PORT / BOJ_BIND_IP / BOJ_CARTRIDGES_ROOT are read at release boot, not baked at compile time — fixes the listener binding to 127.0.0.1 (unreachable via port-map) and cartridges_loaded:0 (baked build-path). Deployed and verified live on Hetzner: /health returns 200. Refs #271, #272. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 215 issues detected
View findings[
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "pages-deploy.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in build.yml",
"type": "missing_timeout_minutes",
"file": "build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in pages-deploy.yml",
"type": "missing_timeout_minutes",
"file": "pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "missing_timeout_minutes",
"file": "scorecard-enforcer.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
…artridges_root) With runtime.exs correctly setting cartridges_root=/app/cartridges, Catalog derives the schema mirror at dirname(cartridges_root)/schemas = /app/schemas/cartridge-v1.json (catalog.ex default_schema_path). Ship it there (keep /schemas as fallback). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🔍 Hypatia Security ScanFindings: 215 issues detected
View findings[
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "pages-deploy.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in build.yml",
"type": "missing_timeout_minutes",
"file": "build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in pages-deploy.yml",
"type": "missing_timeout_minutes",
"file": "pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "missing_timeout_minutes",
"file": "scorecard-enforcer.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
🔍 Hypatia Security ScanFindings: 215 issues detected
View findings[
{
"reason": "Action actions/checkout@v4 needs attention",
"type": "unpinned_action",
"file": "pages-deploy.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in build.yml",
"type": "missing_timeout_minutes",
"file": "build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in pages-deploy.yml",
"type": "missing_timeout_minutes",
"file": "pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "missing_timeout_minutes",
"file": "scorecard-enforcer.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes
container/Containerfilebuild and produce a runnable Elixir REST image, and addsconfig/runtime.exsso runtime env is honoured. Discovered while deploying boj-server to Hetzner (now live —https://api.boj-server.net/health→ 200).Six build-rot fixes
scripts/fetch-cartridges.sh(needed by a COPY) andschemas/cartridge-v1.json(Catalog schema mirror) → un-ignored both. (Refs [Bug] container/Containerfile build fails: .dockerignore excludes scripts/fetch-cartridges.sh #271)apk add zig(wolfi rolls forward; newer Zig removedstd.heap.GeneralPurposeAllocator) with the repo-declared 0.15.1 tarball (.tool-versions).cgr.dev/chainguard/elixir:latestis now 403/auth-gated → publicdocker.io/elixir:1.18.4-otp-25.cgr.dev/chainguard/wolfi-baselostgcompat/ncurses-libsand its OpenSSL 3 breaks the OTP-25 crypto NIF (needslibcrypto.so.1.1) →debian:bullseye-slim(matches builder ABI).schemas/cartridge-v1.jsoninto/schemas(Catalog requires it at boot, else RuntimeError).runtime.exs
config/runtime.exsre-readsBOJ_PORT/BOJ_BIND_IP/BOJ_CARTRIDGES_ROOT/BOJ_DATA_DIRat release boot. Without it,mix releasebakes config.exs's env lookups at build time, so:127.0.0.1(unreachable via port-map — required an ugly--network hostworkaround), andcartridges_rootwas a build path →cartridges_loaded:0.Both are fixed by evaluating env at runtime.
Validation
All six fixes applied and verified end-to-end on the Hetzner host — image builds, container runs,
/healthreturns{"status":"ok"}. Once av*tag build runs with this Containerfile,container-publish.ymlwill publish a correct:latest(the current ghcr:latest/:mainare a stale Node MCP-bridge image — #272; this PR is the fix).Closes #271. Refs #272.
🤖 Generated with Claude Code