Repository navigation
fix(docker): stacks stop on TERM, dev and prod images kept apart, shared ARCHIVE_SECRET_KEY, Mailpit for arm64 - #15
Merged
Conversation
…r dies, pass ARCHIVE_SECRET_KEY to the dev stack - docker-compose.prod.yml builds lens-backend:prod and lens-frontend:prod, so make run no longer overwrites the dev images that a plain docker compose up then runs - start.sh (API and web app) exits in Docker when the dev server or its watcher stops - the dev stack reads the root .env, so it uses the same ARCHIVE_SECRET_KEY as native runs - DEVLOG.md: what the stack check found Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SHm6xEw9BLv1pzGRAQduWD
…prod images Folds the Docker fixes first made on the OAuth branch (8728b24) into this change, so there is one Docker PR: make finds docker compose or docker-compose; Mailpit replaces MailHog (arm64); the dev venv and node_modules are anonymous volumes make dev renews; start.sh traps TERM/INT and stops its children, and in Docker still exits when either child dies; lens worker and lens watch stop on TERM; Next's agentRules off; caniuse-lite current. Also: production images are tagged ${LENS_VERSION:-prod}; CHANGELOG says how to keep credentials a dev stack sealed with data_dir/secret.key now that ARCHIVE_SECRET_KEY comes from the root .env. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SHm6xEw9BLv1pzGRAQduWD
4 of 8 tasks
adeelahmad
marked this pull request as ready for review
October 2, 2026 13:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
This is the single Docker PR. It now also carries the Docker fixes from the OAuth branch (8728b24), and that branch will drop them.
docker-compose.prod.ymlbuildslens-backendandlens-frontend, tagged${LENS_VERSION:-prod}. Before, they used the project's default image names, which the dev stack also uses.start.sh(API and web app): the script traps TERM and INT and stops both of its children. In Docker it also exits when either child dies (wait -n). Outside Docker it still waits for both, because macOS ships bash 3.2, which has nowait -n.lens workerandlens watchstop on TERM the same way they stop on Ctrl-C..envas an optionalenv_file, ahead offastapi_backend/.env, so it getsARCHIVE_SECRET_KEY.node_modulesare anonymous volumes thatmake devrenews.makefinds eitherdocker composeor the standalonedocker-compose.agentRules: false, andcaniuse-liteis updated.DEVLOG.mdandCHANGELOG.mddescribe all of the above.Motivation and Context
Before:
make run, a plaindocker compose upran the production web app image, which crashed with "Could not find a production build".docker stopwaited 10 s and then killed the containers (exit 137).ARCHIVE_SECRET_KEY, so Docker and native runs couldn't read each other's stored credentials.After:
Upgrading: credentials that a dev stack stored earlier were encrypted with the volume's
data_dir/secret.key. Either enter them again, or setARCHIVE_SECRET_KEYin.envto that file's contents (see CHANGELOG).Steps to reproduce (if appropriate):
Each of these was checked on the running dev stack:
docker compose stop backend frontend workertook 0.9 s, and all three exited with 0.fastapi devornext devmade its container exit.lens workerstops on TERM:tests/domain/test_cli.pypasses, andruffis clean.--renew-anon-volumes.Setup, login and 21 pages were walked in Chromium on both stacks with no API errors.
Not tested: this sandbox's network policy blocked the Debian mirrors, so the backend was built without its apt packages (ffmpeg, tesseract, LibreOffice), on the lean target. Processing jobs were not run.
docker-compose.prod.ymlis also changed by #19. Whichever of the two merges second needs to keep both changes.Types of changes
Checklist:
🤖 Generated with Claude Code
https://claude.ai/code/session_01SHm6xEw9BLv1pzGRAQduWD