ZacharyZhang-NY
e74dafcd36
Three independently ugly bugs that all fed the same log flood:
* Electron's `WebFrameMain.send` writes every "Render frame was disposed"
to stderr via `console.error`. When the worker fans a second
agent-event past a reloading renderer, we produced thousands of
identical lines and stalled the main loop on stderr I/O. Added a
`mainFrame.detached` guard so the send is short-circuited before
Electron's own catch block fires, and installed a targeted filter in
`suppress-warnings.ts` (now actually imported from the entry point)
so the specific `console.error("Error sending from webFrameMain:"…)`
noise never reaches the terminal. Any other payload still surfaces.
* `dispatchAgentMessage` accepted the human-reader sentinel as a wake
target when an agent replied to `__board__` — `wakeAgentIfPossible`
then called `db.getAgent("__board__")`, threw, and the dispatcher
kept repeating on every send. Strip `HUMAN_SENDER_ID` at
`resolveMessageWakeTargets`, and keep a defense-in-depth guard in the
heartbeat so a stray caller (future automation fan-out) cannot
reintroduce the crash.
* Pi's skills loader rejects any SKILL.md whose frontmatter `name`
diverges from its parent directory. The four bundled `my-writing-style`
copies declared `name: writing-style-skill`, so every install emitted
a warning and dropped the skill. They also lived as orphan gitlinks
(mode 160000 without .gitmodules), and the global `*.md` gitignore
hid every other SKILL.md from version control. Fixed the frontmatter
to match the dir, converted the dangling submodules to plain trees,
and allowlisted `builtin-skills/**/*.md` so a fresh clone carries the
catalogue instead of silently losing it.
114 lines
2.7 KiB
Markdown
114 lines
2.7 KiB
Markdown
# Docker Patterns
|
|
|
|
## Multi-stage Dockerfile (Node.js)
|
|
|
|
```dockerfile
|
|
# Build stage
|
|
FROM node:20-alpine AS builder
|
|
WORKDIR /app
|
|
COPY package*.json ./
|
|
RUN npm ci --only=production && npm cache clean --force
|
|
COPY . .
|
|
RUN npm run build
|
|
|
|
# Production stage
|
|
FROM node:20-alpine AS runner
|
|
WORKDIR /app
|
|
ENV NODE_ENV=production
|
|
RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
|
|
COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
|
|
COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
|
|
USER nodejs
|
|
EXPOSE 3000
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
|
|
CMD wget -qO- http://localhost:3000/health || exit 1
|
|
CMD ["node", "dist/main.js"]
|
|
```
|
|
|
|
## Multi-stage Dockerfile (Python)
|
|
|
|
```dockerfile
|
|
FROM python:3.12-slim AS builder
|
|
WORKDIR /app
|
|
RUN pip install --no-cache-dir poetry
|
|
COPY pyproject.toml poetry.lock ./
|
|
RUN poetry export -f requirements.txt --output requirements.txt
|
|
RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
|
|
|
|
FROM python:3.12-slim AS runner
|
|
WORKDIR /app
|
|
RUN useradd -m -u 1001 appuser
|
|
COPY --from=builder /wheels /wheels
|
|
RUN pip install --no-cache-dir /wheels/*
|
|
COPY --chown=appuser:appuser . .
|
|
USER appuser
|
|
EXPOSE 8000
|
|
HEALTHCHECK --interval=30s --timeout=3s \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"
|
|
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
|
|
```
|
|
|
|
## Docker Compose (Development)
|
|
|
|
```yaml
|
|
version: '3.8'
|
|
services:
|
|
app:
|
|
build:
|
|
context: .
|
|
target: builder # Use dev stage
|
|
volumes:
|
|
- .:/app
|
|
- /app/node_modules
|
|
ports:
|
|
- "3000:3000"
|
|
environment:
|
|
- DATABASE_URL=postgres://user:pass@db:5432/app
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
|
|
db:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: user
|
|
POSTGRES_PASSWORD: pass
|
|
POSTGRES_DB: app
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U user -d app"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
volumes:
|
|
postgres_data:
|
|
```
|
|
|
|
## Security Best Practices
|
|
|
|
| Practice | Implementation |
|
|
|----------|----------------|
|
|
| Non-root user | `USER nodejs` or `USER 1001` |
|
|
| Minimal base image | Use `-alpine` or `-slim` variants |
|
|
| No secrets in image | Use runtime env vars or secrets |
|
|
| Pin versions | `FROM node:20.10.0-alpine` not `latest` |
|
|
| Scan images | `docker scout`, `trivy`, `snyk` |
|
|
| Health checks | `HEALTHCHECK` instruction |
|
|
| .dockerignore | Exclude `node_modules`, `.git`, `.env` |
|
|
|
|
## .dockerignore Template
|
|
|
|
```
|
|
node_modules
|
|
.git
|
|
.env*
|
|
*.md
|
|
Dockerfile*
|
|
docker-compose*
|
|
.dockerignore
|
|
coverage
|
|
.nyc_output
|
|
```
|