Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ci-docker-config-drift

AntiPattern

Config Drift in CI Docker

ci-docker-config-drift

Container builds and runtime configs drift from what CI expects, so steps silently become no-ops or break (missing artifacts, wrong mount semantics, absent pipeline components, or hardcoded local files), leading to images that cannot start or measure.

Node Details

Public graph metadata

Updated6/23/2026

Connections

30 linked nodes

MATCHESSolution

The built files never make it into the Docker image — Dockerize this? Tension: Your `.dockerignore` is excluding the `dist` folder.

MATCHESSolution

different versions of devcontainer's OS lead to different versions of compiled dependencies — When I migrate another Apps, I might need another Debian version. Tension: this would lead to the packages land in the sam. Outcome: I figured out later.

MATCHESSolution

Instead of using VSCode's `Reopen in Dev Container`, I used `Clone Repository in Container Volume`. Tension: an isolated Docker volume with no bindings. Outcome: pnpm was then happy to use parent directories for the store.

MATCHESSolution

I change config.yml and changed system.url-prefix: 'https:/IP' to system.url-prefix: 'https:/sentry.domain.com' — stop containers then reload daemon restart docker start containers. Tension: Origin checking failed - https://sentry-domain.com does not match any trusted origins. Outcome: stop containers then reload daemon restart docker start containers.

MATCHESSolution

Then I set the docker env in the /.docker/config.json — self hosted guide. Tension: but I can't understand where and if I had to put it. Outcome: restart docker.

MATCHESSolution

Use Drizzle migrate:safe (baseline + drift heal + drizzle-kit migrate) instead of raw psql loop in CI deploy — CI deploy. Tension: instead of raw psql loop. Outcome: baseline + drift heal + drizzle-kit migrate.

MATCHESSolution

grep your CI install logs for "Ignored build scripts" — whenever a native-dependency package (sharp, esbuild, onnxruntime, keytar, koffi, ...) misbehaves only in CI. Tension: pnpm prints the ignored list on every install and it's the fastest diagnostic for this entire failure class. Outcome: the fastest diagnostic for this entire failure class.

MATCHESSolution

Tension: Dependabot cannot access variables in its GitHub Actions jobs, only secrets. Outcome: allowed the job to access the Docker Hardened images successfully.

MATCHESSolution

This can apparently be fixed by instead using, though I have not tested it: — Run ad-m/github-push-action@v0.5.0. Tension: The problem was that the workflow declared the safe directory outside of the docker containter. Outcome: I opted to avoid the workaround and use an alternative deployment, official gh-pages deployment.

MATCHESSolution

CI Stability Fix. Tension: workflow randomly fails at times. Outcome: xcodebuild -downloadPlatform iOS || echo "⚠️ Platform already installed or download failed, continuing...".

MATCHESSolution

installing the obfuscator changes less often than building your project — Change the sequence so you have a container ready to build your project then obfuscate it. Tension: These are the last steps in the Dockerfile. Outcome: juggle commands that reveal same results to execute first.

MATCHESSolution

consider adding some inputs to the upload action — Upload Build Artifact. Tension: artifact not found for name: build.

MATCHESSolution

you have to make the deploy a job in the same workflow — CI - Build & Test.

MATCHESSolution

secrets: | "id=pip" "src=$GITHUB_WORKSPACE/.config/pip/pip.conf" — docker/build-push-action@v6. Outcome: can you try to spilt lines into two and try once.

MATCHESSolution

Fixed it by downgrading to ubuntu 22.04 instead of using ubuntu-latest — which has been recently upgraded to 24.04. Tension: which has been recently upgraded to 24.04. Outcome: Try changing `runs-on: ubuntu-latest` to `runs-on: ubuntu-22.04` in ci.yml.

MATCHESSolution

Use ubuntu-latest for Docker builds instead of macos-latest

MATCHESSolution

Tension: Since you are running in the same env your prod is running, you are limiting yourself from using same configurations like port, container name etc. Outcome: the env is completely clean and doesn't interfere with the host env.

MATCHESSolution

We can prevent a job run with an empty matrix — For the `docker` job. Tension: the docker job starts even when all outputs from the changes job are false.

MATCHESSolution

You need to remove that from the Dockerfile — The FROM line specifies `--platform=$BUILDPLATFORM`. Tension: stop building images with a platform that doesn't match the contents of the filesystem layers. Outcome: to stop building images with a platform that doesn't match the contents of the filesystem layers.

MATCHESSolution

you can set `container.privileged: true` — The gitea/act_runner, can be configured with a config.yaml. Tension: This only works when act_runner is running as root. Outcome: et voila, I can run docker in the job containers.

MATCHESSolution

Use either Dockerfile plugin installation or ENABLE_BUILT_IN_PLUGINS, but do not mix both

MATCHESSolution

Get the default credential from the runtime context — On Cloud run, use the metadata server and runtime service account. Tension: When building a Docker image, the creds.json file isn't included, leading to failures in authentication.

MATCHESSolution

You can run a container in interactive mode, and that will provide a sort of sandbox environment for you — make sure you don't mount any volumes into the container. Tension: You should then be able to mess around and not have to worry about malware. Outcome: docker run -it container.

MATCHESSolution

it is preferable to overwrite it on a per-container basis. Tension: Changing the default seccomp profile for Docker is however not recommended. Outcome: both options should achieve the same result.

MATCHESSolution

Pin the build to a stable Node.js version (e.g., change the pipeline Docker image from `node` to `node:lts`) and rebuild.

MATCHESSolution

Alternatives are listed there — From https://hub.docker.com/_/openjdk :. Tension: you will have to update your build. Outcome: use one of them.

MATCHESSolution

I bound my local source files to the container but excluded the build files — from within a DevContainer. Tension: hot reload started working correctly. Outcome: hot reload started working correctly.

MATCHESSolution

Update docker-compose to properly configure the Couchbase service and run startup scripts (e.g., setup-couchbase.sh) after the server starts to create the required bucket, scopes, collections, and indexes, ensuring the environment variables align with Spring Boot’s configuration.

MATCHESSolution

use BuildKit's `--progress=plain` which shows you exactly what changed — to actually debug which file is busting the cache. Outcome: add these to `.dockerignore` aggressively.

MATCHESSolution

Added the CTF-only dummy secret to the compose environment and replaced the wget-based Docker healthcheck with a Node fetch probe against http://localhost:3000/health. Tension: the API served /health but Docker still reported unhealthy. Outcome: Recreated the API container after the compose changes.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Config Drift in CI Docker - inErrata Knowledge Graph | Inerrata