fix(docker): deepresearch Dockerfile line continuation bug - #851
Conversation
…rmed open Checked all 11 open P2 items against current submodule SHAs on main: - 6 CLOSED: BoTZ export syntax, PMOVES.YT MinIO creds, Pipecat MCP allowlist, A2UI env.shared export, A2UI NATS auth, A2UI env.tier-ui.sh - 1 IMPROVED: Open-Notebook /healthz alias added (/metrics still absent) - 4 CONFIRMED OPEN: Open-Notebook SurrealDB root:root, Pipecat metrics, tensorzero RUSTSEC advisories, tensorzero example creds (all Tier 2/3) Also corrected Trivy triage claim: dashboard previously said CVE pins were "added to Dockerfiles" — corrected to "triaged with remediation plan" (archon pins not yet committed, deepresearch status TBD). P2 tracker: 4 open + 1 improved / 17 total (down from 11 open) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…status Submodule update (archon): added Dockerfile.server pip upgrade step for crawl4ai>=0.8.0 (CVE-2026-26216) and langchain-core>=1.2.5 (CVE-2025-68664). Dashboard corrections: - deepresearch: ray==2.52.0 + vllm==0.14.1 were already committed in pmoves/services/deepresearch/Dockerfile:17-20 (previous correction over-stated they were missing) - archon: now COMPLETE with Dockerfile override - Trivy critical CVEs: 2/2 affected images remediated Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Open-Notebook: SurrealDB creds parameterized (#3), /metrics endpoint added (#5). Pipecat metrics (#10), tensorzero RUSTSEC (#13), tensorzero example secrets (#14) closed with documented justification. P2 tracker: 0 open / 17 total (all resolved) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Same line-continuation bug as archon: inline comment after backslash caused the COPY instruction to be absorbed into the RUN command, breaking the build. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Docker Hardening ValidationHardening Validation ReportValidated: Tue Mar 10 21:01:58 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
📝 WalkthroughWalkthroughThis PR updates submodule references for PMOVES-Open-Notebook and pmoves/integrations/archon, refreshes production audit documentation to reflect P2 final resolution status with itemized fixes and closed items, and reorganizes CVE-related comments in the deepresearch Dockerfile. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pmoves/docs/security/P2_SUBMODULE_TRACKER.md (1)
55-59:⚠️ Potential issue | 🟡 MinorDocument CLOSED outcomes in the resolution process.
Line 59 still says every tracker update should end as
FIXEDwith a PR reference, but this PR legitimately closes several items aswontfix,accepted risk, orfalse positive. The process section should reflect that path too.Suggested wording
-4. **Tracker update:** Mark status as FIXED with PR reference and date +4. **Tracker update:** Mark status as FIXED or CLOSED with date and evidence + - **FIXED:** include the submodule PR reference and parent gitlink update after merge + - **CLOSED:** include the justification (for example, wontfix, accepted risk, or false positive) and verification dateAs per coding guidelines, "Use the tracker to mark items as FIXED/ CLOSED with justification and dates; note when items move from OPEN to CLOSED."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docs/security/P2_SUBMODULE_TRACKER.md` around lines 55 - 59, Update the "Tracker update" bullet (the line that currently mandates "Mark status as FIXED with PR reference and date") to allow CLOSED outcomes beyond FIXED; explicitly list permitted statuses such as FIXED, WONTFIX, ACCEPTED_RISK, and FALSE_POSITIVE and require for each a justification and date, and when applicable include the PR reference or other evidence; keep the surrounding bullets ("Submodule branch", "PR", "Parent update", "Tracker update") intact but replace the single-state requirement with this multi-outcome instruction so the resolution process documents CLOSED outcomes consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/docs/security/P2_SUBMODULE_TRACKER.md`:
- Around line 7-14: The document header and final-resolution summary claim 17
total P2 items while the detailed list only shows IDs 1–16; update the tracker
so the totals and dashboard match the enumerated IDs by either adding the
missing P2 entry (the actual item and its status) or changing the stated totals
from 17 to 16 everywhere (including the "Last updated" line and the "Final
resolution (2026-03-10):" paragraph), and if any items were intentionally moved
to "ALL ITEMS CLOSED" add a brief rationale next to those IDs to satisfy the
"Maintain consistency" guideline.
---
Outside diff comments:
In `@pmoves/docs/security/P2_SUBMODULE_TRACKER.md`:
- Around line 55-59: Update the "Tracker update" bullet (the line that currently
mandates "Mark status as FIXED with PR reference and date") to allow CLOSED
outcomes beyond FIXED; explicitly list permitted statuses such as FIXED,
WONTFIX, ACCEPTED_RISK, and FALSE_POSITIVE and require for each a justification
and date, and when applicable include the PR reference or other evidence; keep
the surrounding bullets ("Submodule branch", "PR", "Parent update", "Tracker
update") intact but replace the single-state requirement with this multi-outcome
instruction so the resolution process documents CLOSED outcomes consistently.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2000f432-9d02-4c18-96bf-bdecc5a725c7
📒 Files selected for processing (5)
PMOVES-Open-Notebookpmoves/docs/PRODUCTION_AUDIT_DASHBOARD.mdpmoves/docs/security/P2_SUBMODULE_TRACKER.mdpmoves/integrations/archonpmoves/services/deepresearch/Dockerfile
| Last updated: 2026-03-10 (all P2 items resolved — 0 open / 17 total) | ||
|
|
||
| ## Open Issues | ||
|
|
||
| P2 triage sweep (2026-03-09) verified all 4 production-blocking items are now fixed. 11 open items remain (Tier 2/3 only). | ||
| **ALL P2 ITEMS RESOLVED.** Final sweep 2026-03-10 fixed #3 and #5, closed #10/#13/#14 with documented justification. | ||
|
|
||
| P2 verification sweep (2026-03-10) checked all 11 open items against current submodule SHAs on main. 6 items closed (fixes verified in submodules), 5 remained open. | ||
| Final resolution (2026-03-10): #3 and #5 fixed in Open-Notebook submodule, #10/#13/#14 closed with justification. |
There was a problem hiding this comment.
Reconcile the P2 total before calling the tracker fully closed.
Line 7 and Lines 11-14 say there are 17 total P2 items, but the tables below enumerate 16 unique P2 IDs (1 through 16). Please either add the missing item or change the totals here and in the dashboard; otherwise the final-resolution summary is internally inconsistent.
As per coding guidelines, "Maintain consistency between tracker entries and dashboard, and clearly label any items moved to 'ALL ITEMS CLOSED' with rationale."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pmoves/docs/security/P2_SUBMODULE_TRACKER.md` around lines 7 - 14, The
document header and final-resolution summary claim 17 total P2 items while the
detailed list only shows IDs 1–16; update the tracker so the totals and
dashboard match the enumerated IDs by either adding the missing P2 entry (the
actual item and its status) or changing the stated totals from 17 to 16
everywhere (including the "Last updated" line and the "Final resolution
(2026-03-10):" paragraph), and if any items were intentionally moved to "ALL
ITEMS CLOSED" add a brief rationale next to those IDs to satisfy the "Maintain
consistency" guideline.
2 participants
Summary
RUNblock instead of after a trailing backslashpip installpackage\caused Docker to merge theRUN pip installandCOPYinstructions, breaking the buildRoot Cause
Same class of bug as PR #850 (archon Dockerfile).
Test plan
integrations-ghcrworkflow passes for thedeepresearchmatrix entrydocker build -f pmoves/services/deepresearch/Dockerfile pmovessucceeds locally🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores