feat(docker): resource limits, log rotation, and supply-chain pins - #170
Merged
Conversation
Every long-running compose service now carries a memory and CPU ceiling sized for a small VPS and rotates its own logs at three files of 10 MB, so a crash-looping container can no longer fill the disk. Base images are pinned by digest in the Dockerfiles and every compose file, workflow actions are pinned to full commit SHAs, and Dependabot gains a docker-compose ecosystem entry so the new digest pins stay current. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011TkUEQhzDEpjYSgJLqeBDb
The memory and CPU limits interpolate from the same .env the secrets live in, defaulting to the shipped small-VPS values, so a larger machine is a variable beside the compose file rather than an edit to it — and an upgrade's git checkout has nothing of the operator's to collide with. Under Coolify the same variables are set on the resource, the way MEITH_IMAGE already is. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011TkUEQhzDEpjYSgJLqeBDb
Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011TkUEQhzDEpjYSgJLqeBDb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production-hygiene and supply-chain hardening for the deploy path.
Resource limits and log rotation
Every long-running service in
compose.yml,compose.coolify.yml, andcompose.demo.coolify.ymlnow carries a memory and CPU ceiling and rotates its own logs at three files of 10 MB, so a crash-looping container underrestart: unless-stoppedcan no longer write the disk full. The ceilings default to small-VPS values (web 1g/2 cpus, postgres 1g/1, worker 768m/1, valkey 256m/0.5) and deliberately oversubscribe the documented 2 GB minimum: they exist to contain a failure within one container, not as reservations.The limits interpolate from the environment (
WEB_MEM_LIMIT,WEB_CPUS,POSTGRES_MEM_LIMIT,POSTGRES_CPUS,WORKER_MEM_LIMIT,WORKER_CPUS,REDIS_MEM_LIMIT,REDIS_CPUS), so a by-hand deployment tunes them in the same untracked.envthe secrets live in and a Coolify deployment sets them on the resource the wayMEITH_IMAGEalready works — an upgrade'sgit checkoutnever collides with an operator's tuning, and nobody forks the compose file to resize a board.Digest-pinned images
node:26-alpine,postgres:16-alpine,valkey/valkey:8-alpine,alpine:3.20, andcurlimages/curl:8.11.1are pinned by multi-arch manifest digest across both Dockerfiles and all four compose files. Theghcr.io/meith-dev/meithrelease pin is untouched — releases move it, andrelease-checkstill passes. Dependabot gains adocker-composeecosystem entry for/docker, because the existingdockerentry only reads Dockerfiles and would not bump the compose digests.SHA-pinned workflow actions
actions/checkout,actions/setup-node,pnpm/action-setup, anddocker/login-actionare pinned to full commit SHAs (resolved from their live tags, version kept as a trailing marker for Dependabot) acrossci.yml,release.yml, andcut-release.yml— the workflows that holdpackages: writeand publish rights no longer run whatever a mutable tag points at.Docs, same change
self-hosting.mddocuments the ceilings, the tuning variables, the override-file escape hatch, and the oversubscription rationale;quickstart.mdadds the Coolify equivalent beside theMEITH_IMAGEinstructions;.env.examplelists the new variables;release.mdextends its pinning section to base images and actions.Validated with
docker compose configon every file (profiles included, overrides proven to flow through) and a full greenpnpm verify.🤖 Generated with Claude Code
https://claude.ai/code/session_011TkUEQhzDEpjYSgJLqeBDb
Generated by Claude Code