Skip to content

fix(hub): harden release image dependencies #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crs48 merged 1 commit into from
Mar 9, 2026
Merged

fix(hub): harden release image dependencies #11

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions packages/hub/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,9 +60,12 @@ COPY --from=builder /build/patches/ patches/

RUN apk add --no-cache --virtual .build-deps python3 make g++ \
&& corepack enable \
&& pnpm install --frozen-lockfile --prod --ignore-scripts --filter @xnetjs/hub... \
&& pnpm --filter @xnetjs/hub exec npm rebuild better-sqlite3 \
&& apk del .build-deps
# Keep the runtime image on patched Hono releases without auto-installing optional peer stacks like expo-sqlite.
&& corepack pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --ignore-scripts --config.auto-install-peers=false --filter @xnetjs/hub \

@greptile-apps greptile-apps Bot Mar 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pnpm add drops --frozen-lockfile and the workspace-recursive ... filter

The original command used pnpm install --frozen-lockfile --prod --filter @xnetjs/hub.... The new command drops two important guards:

  1. No --frozen-lockfile — pnpm add is intentionally incompatible with --frozen-lockfile because it must update the lockfile for the two added packages. However, without this flag, pnpm is free to re-resolve any transitive dependency that has a version conflict with the newly pinned hono packages, potentially pulling in package versions that differ from what was tested.

  2. --filter @xnetjs/hub (no ...) — The trailing ... in the original filter tells pnpm to also set up node_modules for every workspace package that hub depends on (@xnetjs/core, @xnetjs/crypto, @xnetjs/data, etc.). Without it, those workspace packages are linked as symlinks but their own transitive production dependencies may not be fully resolved through the workspace machinery, depending on the pnpm version. If any workspace package has prod deps that pnpm would otherwise hoist via the ... traversal, they will be absent at runtime.

A safer approach is to first do a full frozen install of all deps, then layer on only the two hono overrides as an explicit mutation step — or define pnpm overrides in the root package.json so you can still use pnpm install --frozen-lockfile --prod --filter @xnetjs/hub... with the pinned versions baked into the lockfile.

Suggested change
&& corepack pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --ignore-scripts --config.auto-install-peers=false --filter @xnetjs/hub \
&& corepack pnpm install --frozen-lockfile --prod --ignore-scripts --filter @xnetjs/hub... \
&& corepack pnpm add @hono/node-server@1.19.10 hono@4.12.4 --prod --ignore-scripts --config.auto-install-peers=false --filter @xnetjs/hub \

&& corepack pnpm --filter @xnetjs/hub exec npm rebuild better-sqlite3 \
&& apk del .build-deps \
&& rm -rf /root/.cache/node/corepack /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \
&& rm -f /usr/local/bin/corepack /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/pnpm /usr/local/bin/pnpx
Comment on lines +67 to +68

@greptile-apps greptile-apps Bot Mar 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pnpm global content store not cleaned up

The cleanup removes the corepack cache and the npm/corepack module directories, but the pnpm content-addressable global store (typically at /root/.local/share/pnpm/store in Alpine) is not removed. Because all installed packages are hard-linked from that store into node_modules, both copies end up in the same Docker layer and add unnecessary image weight. Adding the store path to the rm -rf call in this RUN layer (before the layer is committed) will drop that size without affecting the live node_modules.

Suggested change
&& rm -rf /root/.cache/node/corepack /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \
&& rm -f /usr/local/bin/corepack /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/pnpm /usr/local/bin/pnpx
&& rm -rf /root/.cache/node/corepack /root/.local/share/pnpm /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/npm \


# Copy built artifacts
COPY --from=builder /build/packages/hub/dist packages/hub/dist/
Expand Down
Loading