Repository navigation
Build the Docker image with Vite+ - #2435
Merged
Merged
Conversation
kmcginnes
added a commit
that referenced
this pull request
Oct 19, 2026
…s differ (#2442) ## Summary The Vite+ image tag in the `Dockerfile` and the `vite-plus` catalog version in `pnpm-workspace.yaml` must be the same release. Only comments kept them in step, and Dependabot opens a separate PR for each, so one could merge without the other. The Docker test build now fails while they differ. **User-facing:** none ```diff test-build-docker-image Checkout + Ensure the Vite+ image matches the vite-plus catalog version Build Docker image ... ``` It also carries 3 review fixes from #2435 that missed its merge: - **`docs/development.md`:** a Vite+ upgrade changes both pins in the same PR. - **`docs/development.md`:** `docker build` pulls from `ghcr.io` as well as `public.ecr.aws`, so a registry allowlist needs both. - **`Dockerfile`:** a comment ties the `rm -rf ... packages/*/node_modules` glob to `pnpm-workspace.yaml`, and says why it isn't `vp run clean:dep`. ## Evidence **Before:** a Dockerfile on `vite-plus:1.2.0` with the catalog on `1.1.0` passed CI. **After:** I ran the new step locally against each case: - `1.1.0` in both: passes - Catalog bumped to `1.2.0`: `FAIL: Dockerfile has vite-plus:1.1.0, pnpm-workspace.yaml has vite-plus 1.2.0` - Dockerfile tag bumped to `1.2.0`: fails - `FROM` line without a tag and digest: fails - Quoted catalog value (`"1.1.0"`): passes ## Merge Danger **Door:** two-way **Impact:** CI The image doesn't change. A future Vite+ bump PR fails the Docker test build until both pins move together. ## Related - Related to #2435
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Dockerfile pinned Node.js a second time in
ENV NODE_VERSION, downloaded it withcurl | tarand no checksum, and installed pnpm through a pinned Corepack. The build and deps stages now run in the official Vite+ image. It installs the Node.js in.node-versionand the pnpm inpackageManager, verifies both, and the runtime stays on the same Amazon Linux 2023 snapshot..node-versionis now the only Node.js pin the image uses.test_build_docker.ymlchecks that the image'snode --versionmatches it.docs/development.mdand the Dependabot comments drop the Corepack andNODE_VERSIONnotes.Evidence
Before: the image's Node.js came from
ENV NODE_VERSION, with no signature or checksum check, and pnpm came from Corepack 0.36.0.After: the image builds with
Done in 15.7s using pnpm v12.8.1. The new CI step reports✓ node v24.21.0, which matches.node-version.Compared with an image built from current
main:/graph-explorerand/usr/localis byte-identical, with the same owners and modes. The only exceptions areDockerfileand pnpm's install metadata./usr/local/bin/nodehas the same SHA-256, so Vite+ fetched the same official build.ExposedPorts,Entrypoint,WorkingDir,User,PATHandHOMEare unchanged.NODE_VERSIONis gone from the image environment.Verified live: I ran both images through every documented deployment path and compared the results:
/statusover HTTP on 80, in notebook mode on 9250, and over HTTPS on 443.config.json, read-write and read-only, gives identical.env,defaultConnection.jsonand/defaultConnection.CONFIGURATION_FOLDER_PATHfolder with a user.envends up with identical contents.cert-infonamed volume written by the published 3.3.0 image work unchanged on the new image. The volume serves the same certificate fingerprint.docker stoptakes 0.13s and exits 0.Merge Danger
Door: two-way
Impact: Docker image
The shipped image has the same contents and behavior. One environment variable disappears:
NODE_VERSIONis no longer set inside the container. Nothing in this repo reads it, and it was only ever set to report the build's Node.js version. Builds now pullghcr.io/voidzero-dev/vite-plus, pinned by digest, in addition to the Amazon Linux image.Related