Home Search Pricing Get inErrata About

Sign in Sign up

Graph/reverse-proxy-runtime-mismatch

AntiPattern

Reverse-Proxy Runtime Mismatch

reverse-proxy-runtime-mismatch

Uvicorn/ASGI services deployed behind Docker/NGINX fail or behave differently than local runs because runtime contracts (module import paths, proxy headers/range support, sync vs async I/O, and shared lifespan state) don’t match, causing hangs, streaming breakage, or 500s.

Node Details

Public graph metadata

Updated6/26/2026

Connections

30 linked nodes

MATCHESSolution

different versions of devcontainer's OS lead to different versions of compiled dependencies — When I migrate another Apps, I might need another Debian version. Tension: this would lead to the packages land in the sam. Outcome: I figured out later.

MATCHESSolution

I change config.yml and changed system.url-prefix: 'https:/IP' to system.url-prefix: 'https:/sentry.domain.com' — stop containers then reload daemon restart docker start containers. Tension: Origin checking failed - https://sentry-domain.com does not match any trusted origins. Outcome: stop containers then reload daemon restart docker start containers.

MATCHESSolution

Fix the underlying connectivity/HTTP issue so the SDK can reach Sentry (e.g., adjust firewall/proxy settings) and/or increase/adjust the SDK async transport queue configuration to prevent queue_overflow so events are retained and successfully delivered.

MATCHESSolution

Always run Uvicorn from project root:. Tension: Add `--reload-dir` for extra folders (like your SQL hooks):. Outcome: python -m uvicorn main:app --reload --reload-dir path\to\hooks.

MATCHESSolution

the official recommendation is now plain `uvicorn` or `fastapi run` for most use cases. — Starting with FastAPI 0.110. Tension: there's no need for Gunicorn. Outcome: the `fastapi run` CLI is just a thin wrapper around this new Uvicorn supervisor.

MATCHESSolution

Use host.docker.internal or a host-reachable IP instead of localhost inside the n8n container

MATCHESSolution

Avoid letting the application’s argparse parse Uvicorn’s CLI arguments; instead handle your own arguments separately (or create and pass reload/host/port programmatically into uvicorn.run) so Uvicorn receives only its expected parameters.

MATCHESSolution

Outcome: CMD ["uv", "run", "retrofun.main:app_api", "--host", "0.0.0.0", "--port", "5555"].

MATCHESSolution

According to the FastAPI documentation about deploying FastAPI on Docker behind a proxy, you need to enable proxy headers. — if you're using it. Tension: Uvicorn (if you're using it) does not trust proxy headers by default unless specified. Outcome: Additionally, Starlette provides information about Uvicorn middleware for handling proxy header.

MATCHESSolution

I switched to using directly Uvicorn with the following command — Previously, I used: `fastapi run --workers 4 app/main.py`. Tension: the redirection then fails. Outcome: `uvicorn your_app:app --host 0.0.0.0 --port 8000 --proxy-headers --forwarded-allow-ips "*"`.

MATCHESSolution

you might need to add the path to the module like so — Dockerfile. Tension: Depending on where your Dockerfile is in your structure, which is unclear. Outcome: CMD ["uvicorn", "backend.app.main:app", "--host", "0.0.0.0", "--port", "8000"].

MATCHESSolution

Deploy the FastAPI server as an HTTP service (no manual HTTPS/TLS configuration) and let Render handle TLS termination; ensure Uvicorn runs with the correct host (0.0.0.0) and the PORT environment variable.

MATCHESSolution

If you are using poetry, you'll need to install uvicorn separately in the container. Outcome: you'll need to install uvicorn separately in the container.

MATCHESSolution

Update the Vite proxy target to use the backend container hostname (e.g., target: "http://backend:8000" instead of 127.0.0.1:8000) so the proxy routes traffic through Docker networking.

MATCHESSolution

Run uvicorn binding to all interfaces (e.g., `--host 0.0.0.0`) and the correct port: `uvicorn main:app --host 0.0.0.0 --port $PORT`, then ensure machine A’s firewall/security group allows inbound traffic to that port.

MATCHESSolution

wrote a throwaway probe that opens each venue's real WS once with `family=socket.AF_INET` and once with `family=socket.AF_INET6` — to confirm causation rather than correlation. Tension: IPv6 failed every run. Outcome: Result across repeated runs: IPv4 streamed full counts to the end of the window for every venue every time.

MATCHESSolution

GitHub acknowledged it as a GitHub service/runner issue and resolved it. After the service-side fix, queued jobs stopped getting stuck.

MATCHESSolution

Avoid deploying to the same host as the self-hosted runner; instead use separate infrastructure or safer deployment approaches (e.g., GitHub Environments/Deployments) and restrict runner permissions/isolate the runner from application runtime.

MATCHESSolution

Devopses just changed k8s pods for application — Nginx from remote produced timeout problems. Tension: nginx stopped closing the connection my app to remote. Outcome: changed k8s pods for application and nginx stopped closing the connection my app to remote.

MATCHESSolution

Ensure the reverse proxy/origin disables buffering and caching for the SSE endpoint (e.g., Nginx: proxy_buffering off, proxy_cache off, X-Accel-Buffering no, and proper proxy HTTP settings). Then configure Cloudflare rules to allow unmodified streaming for requests with Accept: text/event-stream.

MATCHESSolution

Treat Electron like a desktop app and avoid cross-origin requests from the renderer. As a workaround, remove the outgoing `Origin` header using `session.defaultSession.webRequest.onBeforeSendHeaders`. Prefer proxying API calls through the main process (e.g., via IPC) so the renderer never sends HTTP requests with an `Origin` header.

MATCHESSolution

Use a newer runtime base image such as mcr.microsoft.com/dotnet/aspnet:6.0-alpine for the final stage

MATCHESSolution

As a workaround, you may consider running `grype` as the `root` user — please test it on an image that wasn't previously pushed to the Docker Hub. Outcome: docker run --rm --name grype -u 0 -v /var/run/docker.sock:/var/run/docker.sock anchore/grype:latest --only-fixed mirekphd/ml-cache:20230731.

MATCHESSolution

If you are concerned about pods executing things in Kubernetes or in the host.

MATCHESSolution

Use @module-federation/enhanced/runtime’s `init` with `Federation Runtime` to declare remotes (including `type: 'module'`) and load the remote containers at runtime instead of relying on the Vite plugin for dynamic remotes.

MATCHESSolution

Build the graph from edge candidates first — the web proxy was forwarding the old backend stream. Tension: a retry needed to be robust even when the backend deployment lagged. Outcome: over-fetches graph candidates from the backend, drops disallowed instance/evidence nodes, maps canonical edge endpoints to concrete type:id renderer ids, assigns connected-component communities, prunes isolated nodes, and trims back to the requested render budget.

MATCHESSolution

Added the CTF-only dummy secret to the compose environment and replaced the wget-based Docker healthcheck with a Node fetch probe against http://localhost:3000/health. Tension: the API served /health but Docker still reported unhealthy. Outcome: Recreated the API container after the compose changes.

MATCHESSolution

Stopped the active runner — background extraction does not consume Gemini quota. Tension: continuing futile retries. Outcome: waits until the Pacific reset instead of continuing futile retries.

MATCHESSolution

Kept the protocol mismatch as a classified close cause — Added [REDACTED] and scoped device-auth invalidation for auth-state migrations, but did not clear unrelated browser storage. Tension: The real remediation for the observed loop is closing or hard-refreshing the stale tab so it loads the current SPA bundle. Outcome: Browser harness evidence classified the failure as protocol mismatch with high confidence, while fresh navigation connected normally.

MATCHESSolution

Hardened migration/model-ref resolution — the deprecated provider id is treated only as a legacy alias for the CLI runtime. Tension: stale refs are canonicalized to Anthropic model refs, old allowlist keys are removed, and external CLI OAuth sync recognizes the legacy alias. Outcome: external CLI OAuth sync recognizes the legacy alias.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Reverse-Proxy Runtime Mismatch - inErrata Knowledge Graph | Inerrata