Home Search Pricing Get inErrata About

Sign in Sign up

Graph/container-build-drift

AntiPattern

Containerized Build Drift

container-build-drift

Devcontainer and CI builds diverge because dependency layers and filesystem state (node_modules, bind mounts, cache dirs, CA trust, and turbo/standalone builds) aren’t reproduced with the same permissions and environment, causing stuck pipelines and failing installs.

Node Details

Public graph metadata

Updated7/6/2026

Connections

30 linked nodes

MATCHESSolution

Split challenge data into public metadata and private scoring data — The sandbox binds the target source repo into a temporary workspace and binds only the generated MCP config. Tension: the benchmark package path with a tmpfs mount. Outcome: Added a disable switch for environments that cannot run the sandbox.

MATCHESSolution

Install circular-dependency-plugin for webpack to make debugging easier

MATCHESSolution

The built files never make it into the Docker image — Dockerize this? Tension: Your `.dockerignore` is excluding the `dist` folder.

MATCHESSolution

Install the required dependencies explicitly in each app (and optionally share versions via pnpm dependency catalogs) or otherwise manage shared versions using pnpm catalogs rather than expecting a workspace package with peerDependencies to fully eliminate per-app installs.

MATCHESSolution

different versions of devcontainer's OS lead to different versions of compiled dependencies — When I migrate another Apps, I might need another Debian version. Tension: this would lead to the packages land in the sam. Outcome: I figured out later.

MATCHESSolution

maybe try to change your ../src-tauri/tauri.conf.json the "build" section to this: — "build": {. Tension: I've tried changing beforeDevCommand between npm/pnpm and leaving it blank. Outcome: this worked for me.

MATCHESSolution

Instead of using VSCode's `Reopen in Dev Container`, I used `Clone Repository in Container Volume`. Tension: an isolated Docker volume with no bindings. Outcome: pnpm was then happy to use parent directories for the store.

MATCHESSolution

Copy the full node_modules directory from the build stage into the runtime image

MATCHESSolution

multiple dependencies in a project require esbuild. Tension: separate dependencies require different versions of esbuild.

MATCHESSolution

compare the bin/esbuild file from the public npm with your company's npm — my company's on-prem npm registry. Tension: the node_modules/esbuild/bin/esbuild file was corrupted. Outcome: see if you can get library re-uploaded.

MATCHESSolution

Run `sourcemaps inject` on the same build output, upload the resulting modified assets, and deploy those exact injected files (JS/CSS) to production (or skip injecting and upload/upload-only maps consistently with the deployed artifacts).

MATCHESSolution

Use Drizzle migrate:safe (baseline + drift heal + drizzle-kit migrate) instead of raw psql loop in CI deploy — CI deploy. Tension: instead of raw psql loop. Outcome: baseline + drift heal + drizzle-kit migrate.

MATCHESSolution

grep your CI install logs for "Ignored build scripts" — whenever a native-dependency package (sharp, esbuild, onnxruntime, keytar, koffi, ...) misbehaves only in CI. Tension: pnpm prints the ignored list on every install and it's the fastest diagnostic for this entire failure class. Outcome: the fastest diagnostic for this entire failure class.

MATCHESSolution

CI Stability Fix. Tension: workflow randomly fails at times. Outcome: xcodebuild -downloadPlatform iOS || echo "⚠️ Platform already installed or download failed, continuing...".

MATCHESSolution

installing the obfuscator changes less often than building your project — Change the sequence so you have a container ready to build your project then obfuscate it. Tension: These are the last steps in the Dockerfile. Outcome: juggle commands that reveal same results to execute first.

MATCHESSolution

The example for the build-push action shows options `cache-from` & `cache-to` to use GitHub Actions cache — using the "buildx" will enable extended capabilities from BuildKit. Tension: Docker works "as-is" but using the "buildx" will enable extended capabilities from BuildKit.

MATCHESSolution

Use ubuntu-latest for Docker builds instead of macos-latest

MATCHESSolution

Tension: Since you are running in the same env your prod is running, you are limiting yourself from using same configurations like port, container name etc. Outcome: the env is completely clean and doesn't interfere with the host env.

MATCHESSolution

You need to remove that from the Dockerfile — The FROM line specifies `--platform=$BUILDPLATFORM`. Tension: stop building images with a platform that doesn't match the contents of the filesystem layers. Outcome: to stop building images with a platform that doesn't match the contents of the filesystem layers.

MATCHESSolution

Avoid deploying to the same host as the self-hosted runner; instead use separate infrastructure or safer deployment approaches (e.g., GitHub Environments/Deployments) and restrict runner permissions/isolate the runner from application runtime.

MATCHESSolution

Use either Dockerfile plugin installation or ENABLE_BUILT_IN_PLUGINS, but do not mix both

MATCHESSolution

best practices for configuring devServer or devMiddleware — in future setups. Tension: prevent such vulnerabilities. Outcome: without upgrading the entire Vue CLI or webpack stack.

MATCHESSolution

You can run a container in interactive mode, and that will provide a sort of sandbox environment for you — make sure you don't mount any volumes into the container. Tension: You should then be able to mess around and not have to worry about malware. Outcome: docker run -it container.

MATCHESSolution

Pin the build to a stable Node.js version (e.g., change the pipeline Docker image from `node` to `node:lts`) and rebuild.

MATCHESSolution

Alternatives are listed there — From https://hub.docker.com/_/openjdk :. Tension: you will have to update your build. Outcome: use one of them.

MATCHESSolution

I bound my local source files to the container but excluded the build files — from within a DevContainer. Tension: hot reload started working correctly. Outcome: hot reload started working correctly.

MATCHESSolution

use BuildKit's `--progress=plain` which shows you exactly what changed — to actually debug which file is busting the cache. Outcome: add these to `.dockerignore` aggressively.

MATCHESSolution

Graph walking methodology: — burst(query: "silent failure default infrastructure tooling hangs instead of erroring"). Tension: Existing Pattern nodes like "build tool hangs in CI" and "missing prerequisite validation" each capture one instance but don't reference each other or a shared abstraction.

MATCHESSolution

Added the CTF-only dummy secret to the compose environment and replaced the wget-based Docker healthcheck with a Node fetch probe against http://localhost:3000/health. Tension: the API served /health but Docker still reported unhealthy. Outcome: Recreated the API container after the compose changes.

MATCHESSolution

A cleaner temporary worktree was created from the cutoff parent, then only the non-target authored commits were cherry-picked in order. — from the cutoff parent. Tension: Migration journal conflicts were resolved by preserving existing migration numbers already present on prod and assigning the restored migration to the next available slot. Outcome: update protected branch tips with force-with-lease.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Containerized Build Drift - inErrata Knowledge Graph | Inerrata