From db8adcbc18602a6687ddabce152fa593ca43f319 Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:35:43 -0300 Subject: [PATCH 1/7] Update ignored files by docker --- .dockerignore | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.dockerignore b/.dockerignore index b7edad4..87ed4ab 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,5 +1,7 @@ .git -.circleci +.github +.DS_Store +coverage log/* tmp/* !log/.keep From d38d970fb59568fe5b3712b7cd68b29465142333 Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:37:02 -0300 Subject: [PATCH 2/7] Set docker syntax directive This just ensures BuildKit uses the latest version of Dockerfile syntax --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index a96077a..6bf78a8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,3 +1,4 @@ +# syntax=docker/dockerfile:1 FROM ruby:4.0.4 RUN dpkg --add-architecture i386 \ From e2c8f6ecde190fe4dea391b14985df7a6a10e394 Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:40:19 -0300 Subject: [PATCH 3/7] Configure bundler settings in the environment This lets us drop the options in the command and also guarantees these options are set when running bundler commands inside the container. Using an absolute path for BUNDLE_GEMFILE also guarantees bundler commands work properly in subdirectories inside the container --- Dockerfile | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 6bf78a8..09053ee 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,17 +20,21 @@ RUN dpkg --add-architecture i386 \ chromium-driver \ && rm -rf /var/lib/apt/lists/* -RUN gem install bundler -v 2.2.21 - WORKDIR /app -COPY Gemfile Gemfile.lock ./ -RUN bundle _2.2.21_ install --jobs=4 --retry=3 +ENV BUNDLE_GEMFILE=/app/Gemfile \ + BUNDLE_JOBS=4 \ + BUNDLE_RETRY=3 + +COPY Gemfile Gemfile.lock .ruby-version ./ +RUN --mount=type=cache,target=/usr/local/bundle/cache,sharing=locked \ + bundle install # Dual-boot: Gemfile.next targets the Rails version we're upgrading to. # Remove this block (and Gemfile.next / Gemfile.next.lock) once the upgrade lands. COPY Gemfile.next Gemfile.next.lock ./ -RUN BUNDLE_GEMFILE=Gemfile.next bundle _2.2.21_ install --jobs=4 --retry=3 +RUN --mount=type=cache,target=/usr/local/bundle/cache,sharing=locked \ + BUNDLE_GEMFILE=/app/Gemfile.next bundle install COPY . . From c55ab042b97c6360ff5be5ebd440f3874715f3bf Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:42:40 -0300 Subject: [PATCH 4/7] Copy entrypoint before app files This prevents cache busting the entrypoint copy on changes to the application code. --- Dockerfile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 09053ee..2285774 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,10 +36,9 @@ COPY Gemfile.next Gemfile.next.lock ./ RUN --mount=type=cache,target=/usr/local/bundle/cache,sharing=locked \ BUNDLE_GEMFILE=/app/Gemfile.next bundle install -COPY . . +COPY --chmod=0755 docker/entrypoint.sh /usr/local/bin/entrypoint.sh -COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh -RUN chmod +x /usr/local/bin/entrypoint.sh +COPY . . EXPOSE 3000 From 79f1da930a6d0c845c0955e9ee65097524b49d47 Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:45:35 -0300 Subject: [PATCH 5/7] Tie web_next dependency on service_healthy service_started doesn't prevent race conditions since the web service may have started and db operations might still be working. Rails provides an `/up` endpoint which guarantees the _app_ is up. Only after that is it safe to run the entrypoint script --- Dockerfile | 3 +++ docker-compose.yml | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 2285774..da01235 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,5 +42,8 @@ COPY . . EXPOSE 3000 +HEALTHCHECK --interval=10s --timeout=3s --start-period=60s --retries=6 \ + CMD curl -fsS http://localhost:3000/up || exit 1 + ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"] diff --git a/docker-compose.yml b/docker-compose.yml index ff7f614..2bc2370 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -58,7 +58,7 @@ services: db: condition: service_healthy web: - condition: service_started + condition: service_healthy stdin_open: true tty: true From 109794488d6cbe4db16abdec2d9708bc55e1743d Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:46:09 -0300 Subject: [PATCH 6/7] Use absolute path for BUNDLE_GEMFILE in web_next --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 2bc2370..7f5671b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -53,7 +53,7 @@ services: DATABASE_HOST: db DATABASE_USERNAME: postgres DATABASE_PASSWORD: postgres - BUNDLE_GEMFILE: Gemfile.next + BUNDLE_GEMFILE: /app/Gemfile.next depends_on: db: condition: service_healthy From f274c77caea67834efdfc76a0ba01a6311e8a6b0 Mon Sep 17 00:00:00 2001 From: Mateus Pereira Date: Wed, 29 Jul 2026 09:47:33 -0300 Subject: [PATCH 7/7] Build web_next image Attempting to reuse the web image presumes it already exists locally. Furthermore, it's better to have them build separately since their dependencies can be different --- docker-compose.yml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7f5671b..b6b24aa 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -34,12 +34,7 @@ services: tty: true web_next: - # Reuse the image built for `web` (compose tags it -web, i.e. - # audit-web) instead of building a second image. Only BUNDLE_GEMFILE - # differs, so a separate build is unnecessary. (Not using `extends` here: - # it merges array fields like `ports` instead of overriding them, which - # would leak web's 3000:3000 mapping into this service too.) - image: audit-web + build: . platform: linux/amd64 # Distinct pidfile: web and web_next share the same bind-mounted /app, so # they'd otherwise race on tmp/pids/server.pid and refuse to boot together.