From afde2cb47155890e91cb317c720403e35908934f Mon Sep 17 00:00:00 2001 From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com> Date: Mon, 26 Oct 2026 12:45:36 +0100 Subject: [PATCH] fix(deployments): write generated compose file after image build (#12331) --- app/Jobs/ApplicationDeploymentJob.php | 9 ++ .../DeploymentSensitiveCommandFailureTest.php | 3 +- ...eneratedComposeOutsideBuildContextTest.php | 101 ++++++++++++++++++ 3 files changed, 112 insertions(+), 1 deletion(-) create mode 100644 tests/Feature/GeneratedComposeOutsideBuildContextTest.php diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php index cf206973c6..658dc2f131 100644 --- a/app/Jobs/ApplicationDeploymentJob.php +++ b/app/Jobs/ApplicationDeploymentJob.php @@ -2717,6 +2717,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue { try { $this->checkForCancellation(); + $this->write_compose_file_to_workdir(); if ($this->server->isSwarm()) { $this->application_deployment_queue->addLogEntry('Rolling update started.'); $this->execute_remote_command( @@ -4467,6 +4468,14 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf"); $this->docker_compose = Yaml::dump($docker_compose, 10); $this->generated_docker_compose = $this->docker_compose; + } + + /** + * The workdir is the build context, so the generated compose file is written only after the image + * build. Otherwise `COPY . .`, Nixpacks, and Railpack put it (with the proxy labels) into the image. + */ + private function write_compose_file_to_workdir(): void + { $this->execute_remote_command([ "docker exec {$this->deployment_uuid} rm -f {$this->workdir}/docker-compose.yaml", 'hidden' => true, diff --git a/tests/Feature/DeploymentSensitiveCommandFailureTest.php b/tests/Feature/DeploymentSensitiveCommandFailureTest.php index c0c4882168..fe7346a5cd 100644 --- a/tests/Feature/DeploymentSensitiveCommandFailureTest.php +++ b/tests/Feature/DeploymentSensitiveCommandFailureTest.php @@ -457,7 +457,8 @@ it('streams the compose file over stdin so its content stays out of commands, er return Process::result(); }); - $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'generate_compose_file')); + invokeSensitiveFailureJobMethod($job, $reflection, 'generate_compose_file'); + $exception = captureDeploymentException(fn () => invokeSensitiveFailureJobMethod($job, $reflection, 'write_compose_file_to_workdir')); $compose = (string) readSensitiveFailureJobProperty($job, $reflection, 'docker_compose'); expect($composeWrite)->not->toBeNull() diff --git a/tests/Feature/GeneratedComposeOutsideBuildContextTest.php b/tests/Feature/GeneratedComposeOutsideBuildContextTest.php new file mode 100644 index 0000000000..4b3f1413db --- /dev/null +++ b/tests/Feature/GeneratedComposeOutsideBuildContextTest.php @@ -0,0 +1,101 @@ + InstanceSettings::firstOrCreate(['id' => 0])); + config(['constants.ssh.mux_enabled' => false]); + + $team = Team::factory()->create(); + $server = Server::factory()->create([ + 'team_id' => $team->id, + 'private_key_id' => PrivateKey::factory()->create(['team_id' => $team->id])->id, + ]); + $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail(); + $project = Project::factory()->create(['team_id' => $team->id]); + $environment = Environment::factory()->create(['project_id' => $project->id]); + $this->application = Application::factory()->create([ + 'environment_id' => $environment->id, + 'destination_id' => $destination->id, + 'destination_type' => $destination->getMorphClass(), + 'build_pack' => 'dockerfile', + 'dockerfile' => "FROM nginx:alpine\nCOPY . /usr/share/nginx/html", + ]); + $this->deployment = ApplicationDeploymentQueue::create([ + 'application_id' => $this->application->id, + 'deployment_uuid' => 'compose-outside-build-context', + 'status' => 'in_progress', + 'server_id' => $server->id, + 'destination_id' => $destination->id, + 'commit' => 'HEAD', + 'pull_request_id' => 0, + ]); + + $this->commands = collect(); + Process::fake(function (PendingProcess $process) { + $command = (string) $process->command; + $this->commands->push($command); + + return Process::result(output: match (true) { + str_contains($command, 'State.Health.Status') => "\"healthy\"\n", + str_contains($command, 'echo available') => "available\n", + default => '', + }); + }); + Queue::fake(); + Notification::fake(); + Sleep::fake(); +}); + +it('writes the generated compose file to the workdir only after the image build', function (string $buildPack, string $deployMethod) { + // Application clears the inline Dockerfile when the build pack changes away from dockerfile. + $this->application->update(['build_pack' => $buildPack]); + $job = new ApplicationDeploymentJob($this->deployment->id); + // handle() detects buildx on the server before it starts a deployment. + (new ReflectionProperty($job, 'dockerBuildxAvailable'))->setValue($job, true); + try { + (new ReflectionMethod($job, $deployMethod))->invoke($job); + } catch (Throwable) { + // The faked server stops the deployment after the start; only the order of the commands matters. + } + + $buildIndex = $this->commands->search(fn (string $command) => str_contains($command, 'bash /artifacts/build.sh')); + $composeWriteIndex = $this->commands->search(fn (string $command) => str_contains($command, 'tee /artifacts/compose-outside-build-context/docker-compose.yaml')); + + if ($buildPack === 'nixpacks') { + expect($this->commands->contains(fn (string $command) => str_contains($command, 'nixpacks build')))->toBeTrue(); + } + + expect($buildIndex)->not->toBeFalse() + ->and($composeWriteIndex)->not->toBeFalse() + ->and($composeWriteIndex)->toBeGreaterThan($buildIndex); +})->with([ + 'inline Dockerfile' => ['dockerfile', 'deploy_simple_dockerfile'], + 'Dockerfile' => ['dockerfile', 'deploy_dockerfile_buildpack'], + 'Nixpacks' => ['nixpacks', 'deploy_nixpacks_buildpack'], + 'Railpack' => ['railpack', 'deploy_railpack_buildpack'], + 'static' => ['static', 'deploy_static_buildpack'], +]);