Repository navigation
feat(mcpx): ship static container build + tier-2 container legs (#1987) - #2705
Conversation
Containerfile now defaults CGO_ENABLED=0 (the static build #182 measured but left as a goal) and fails the build if the binary does not record the CGO_ENABLED it was built with. docs/container.md section 4 becomes the static-artifact policy record: nix package and container binary ship static, the image as a whole does not (bun is dynamic), release tarball left to #1881. Tier-2 legs (scripts/tier2-containers.sh, run nightly + on main by the new mcpx-tier2-containers workflow): alpine non-exec, alpine + bun-musl exec, scratch non-exec, distroless-static non-exec, distroless/cc + deno exec. Non-exec legs assert mcpxs clean no-usable-runtime refusal. All five legs verified locally with docker, plus the shipped image (ldd: not a dynamic executable). Deferred with reason: alpine + nodejs exec — mcpxs node path dies with ERR_NO_TYPESCRIPT under Alpines nodejs build; filed as #2699 and recorded in docs/container.md section 4.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 28 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ce1dd89ac
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| docker run --rm --entrypoint sh mcpx-tier2-image \ | ||
| -c 'ldd /usr/local/bin/mcpx' | grep -q 'not a dynamic executable' |
There was a problem hiding this comment.
For the intended static mcpx artifact, glibc's ldd writes not a dynamic executable to stderr and exits 1; its implementation explicitly redirects the diagnostic with >&2 and sets result=1, which I also reproduced locally with a static ELF binary. This pipeline only sends stdout to grep, so the shipped-image verification job fails even when the build is correct and never reaches --version. Capture stderr and handle the expected nonzero status before asserting the diagnostic; redirecting stderr alone would still fail under the workflow shell's pipefail behavior.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in the follow-up commit just pushed. The shipped-image check no longer pipes ldd into grep: it captures the docker run output (with ldd stderr redirected inside the container and the expected exit 1 tolerated via || true) and asserts on the captured text, so pipefail cannot fail the step for the static success case. The --version run that follows is unchanged.
…c-container # Conflicts: # pkgs/mcpx/Containerfile
Implements the #1987 follow-up packet (task 3283; triage 2892):
1. Containerfile ships/tests a static mcpx.
ARG CGO_ENABLEDdefault flips 1 → 0 (the build #182 measured end-to-end but left as "a goal, not a state"), and the build now fails if the binary doesn't record theCGO_ENABLEDit was built with (go version -massertion).--build-arg CGO_ENABLED=1still gives the old glibc build.2. Static-artifact policy recorded in
docs/container.md§4: nix package and the container binary ship static; the image as a whole does not (bun is a dynamic distribution binary — the runtime stage is Debian for bun now, not for mcpx); the release tarball is #1881's call, with this policy as its input.3. Tier-2 container legs wired as
pkgs/mcpx/scripts/tier2-containers.sh+ new workflow.github/workflows/mcpx-tier2-containers.yml(push-to-main onpkgs/mcpx/**, nightly, dispatch — tier 2 never gates PRs). Legs: alpine non-exec, alpine + bun-musl exec,FROM scratchnon-exec, distroless-static non-exec, distroless/cc + deno exec. Non-exec legs assert mcpx's clean "no usable JavaScript runtime" refusal rather than skipping.Verification (laptop, docker — PR-head CI no longer exists under the main-only model):
scripts/tier2-containers.shall legs passed (binary:statically linked,CGO_ENABLED=0)ldd /usr/local/bin/mcpx→ "not a dynamic executable";--version→mcpx 0.1.0Deferred with reason (also recorded on #1987 and in docs §4): the alpine + nodejs exec leg — mcpx's node path dies with
ERR_NO_TYPESCRIPTunder Alpine's nodejs build. Filed as #2699 with repro and acceptance; the leg joins the matrix when that is fixed.Refs #1987 (issue stays open for its tier-3 remainder: fedora/flatpak/silverblue/Windows are separate issues when wanted).
Need help on this PR? Tag
@codesmith-botwith what you need.