feat: add Railway deployment config for verification worker#1
Open
oneshot2001 wants to merge 3 commits intomainfrom
Open
feat: add Railway deployment config for verification worker#1oneshot2001 wants to merge 3 commits intomainfrom
oneshot2001 wants to merge 3 commits intomainfrom
Conversation
Adds a lightweight Dockerfile.mock (python:3.11-slim, no SVF compilation) and railway.json for fast initial Railway deployment with USE_MOCK_RESULTS=true. The full SVF build path (Dockerfile) remains intact for when real verification is needed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: defaults Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds V1 Enterprise REST API documentation, expands API key validation/audit logging and test structure notes, and adds a Python worker Dockerfile mock plus Railway and Vercel/Next.js deployment/config files. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@worker/Dockerfile.mock`:
- Around line 1-16: Create and switch to a non-root user in the Dockerfile: add
steps to create a dedicated user (e.g., "appuser"), create or set a group if
desired, set appropriate ownership for /app and /app/certs (chown to appuser),
set HOME and switch to that user with USER appuser before the CMD so uvicorn
runs unprivileged; ensure any files created earlier (installed packages, copied
files) are accessible by that user and avoid running pip as root at runtime by
doing installation during build as root but ensuring the app directory
permissions are changed for the non-root user.
Comment on lines
+1
to
+16
| FROM python:3.11-slim | ||
|
|
||
| WORKDIR /app | ||
|
|
||
| COPY requirements.txt . | ||
| RUN pip3 install --no-cache-dir -r requirements.txt | ||
|
|
||
| COPY certs/ /app/certs/ | ||
| COPY app/ /app/app/ | ||
|
|
||
| EXPOSE 8000 | ||
|
|
||
| ENV USE_MOCK_RESULTS=true | ||
|
|
||
| # Use Railway's injected $PORT if set, otherwise fall back to 8000 | ||
| CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000}"] |
There was a problem hiding this comment.
Run the container as a non-root user.
The image currently runs as root, which weakens container isolation and increases blast radius if compromised.
🔒 Proposed hardening patch
FROM python:3.11-slim
WORKDIR /app
COPY requirements.txt .
RUN pip3 install --no-cache-dir -r requirements.txt
COPY certs/ /app/certs/
COPY app/ /app/app/
+
+RUN addgroup --system app && adduser --system --ingroup app app \
+ && chown -R app:app /app
EXPOSE 8000
ENV USE_MOCK_RESULTS=true
+USER app
# Use Railway's injected $PORT if set, otherwise fall back to 8000
CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000}"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| FROM python:3.11-slim | |
| WORKDIR /app | |
| COPY requirements.txt . | |
| RUN pip3 install --no-cache-dir -r requirements.txt | |
| COPY certs/ /app/certs/ | |
| COPY app/ /app/app/ | |
| EXPOSE 8000 | |
| ENV USE_MOCK_RESULTS=true | |
| # Use Railway's injected $PORT if set, otherwise fall back to 8000 | |
| CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000}"] | |
| FROM python:3.11-slim | |
| WORKDIR /app | |
| COPY requirements.txt . | |
| RUN pip3 install --no-cache-dir -r requirements.txt | |
| COPY certs/ /app/certs/ | |
| COPY app/ /app/app/ | |
| RUN addgroup --system app && adduser --system --ingroup app app \ | |
| && chown -R app:app /app | |
| EXPOSE 8000 | |
| ENV USE_MOCK_RESULTS=true | |
| USER app | |
| # Use Railway's injected $PORT if set, otherwise fall back to 8000 | |
| CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8000}"] |
🧰 Tools
🪛 Trivy (0.69.1)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@worker/Dockerfile.mock` around lines 1 - 16, Create and switch to a non-root
user in the Dockerfile: add steps to create a dedicated user (e.g., "appuser"),
create or set a group if desired, set appropriate ownership for /app and
/app/certs (chown to appuser), set HOME and switch to that user with USER
appuser before the CMD so uvicorn runs unprivileged; ensure any files created
earlier (installed packages, copied files) are accessible by that user and avoid
running pip as root at runtime by doing installation during build as root but
ensuring the app directory permissions are changed for the non-root user.
…ss output Without this file Vercel defaults to framework=null and serves from the public/ directory instead of tracing Next.js serverless functions. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a lightweight Dockerfile.mock (python:3.11-slim, no SVF compilation) and railway.json for fast initial Railway deployment with USE_MOCK_RESULTS=true. The full SVF build path (Dockerfile) remains intact for when real verification is needed.
Summary by CodeRabbit
New Features
Documentation
Chores