feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images - #6329
feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images#6329avallete wants to merge 7 commits into
Conversation
When SUPABASE_USE_SLIM_IMAGES is "true" or "1", the legacy shell resolves its local-stack Docker images from the slim ghcr.io/supabase/cli/<service> builds instead of the docker.io images pinned in the embedded Dockerfile manifest, keeping the Dockerfile version pins translated into the slim tag scheme via @supabase/stack's catalog (new "./versions" package export). Services with no slim build keep their docker.io reference: kong, the differ/migra/pgprove job images, the pg 13/14/15 major-version fallbacks, OrioleDB overrides, and the deno_version = 1 edge-runtime pin. Slim refs bypass the SUPABASE_INTERNAL_IMAGE_REGISTRY/ECR rewrite (they exist only at ghcr.io/supabase/cli), status/--exclude short names stay flag-invariant, services-command image overrides are never translated, and the declarative stale-container guard now rejects slim/non-slim family mismatches. With the flag unset, behavior is byte-identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92576b1233
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@c030668ec95c5fdbcabffa9f3fed40be9cdbcff3Preview package for commit |
With SUPABASE_USE_SLIM_IMAGES on and a resolved ghcr.io/supabase/cli/postgres ref, the main-db and shadow-db container specs switch to the slim image's contract: the image entrypoint is kept (entry.sh self-initializes and passes container argv through to postgres), config.toml db settings travel as -c argv pairs, and the CLI's bootstrap schema plus pgsodium root key are staged via the existing secret-file docker cp — the image's bundled migrate.sh runs /etc/postgresql.schema.sql as its first-boot postinit, giving exactly-once semantics without any CLI-side marker. PGSODIUM_KEY_FILE keeps the root key deterministic for the non-root (uid 65532) image user. start --from-backup refuses a slim resolved ref with a typed error until the restore flow learns the slim contract. Flag off (or a registry override landing on docker.io) stays byte-identical. Verified against a real slim db start: healthy container, settings applied, all three schema templates present exactly once across restarts, root key loaded, shadow spec exercised. Shadow flows additionally need a slim-services image fix (empty supautils GUCs block "create extension pg_net"). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efba3aa535
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…slim-images-flag-c95c16 # Conflicts: # apps/cli/src/legacy/commands/start/SIDE_EFFECTS.md # apps/cli/src/legacy/shared/db-bootstrap/postgres.service.unit.test.ts
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cbb49da949
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reusing a named database volume initialized by the docker.io postgres image under SUPABASE_USE_SLIM_IMAGES crash-loops the slim image's non-root user against the 700-mode PGDATA until the health check times out. Before creating the container on an existing volume, a cheap docker-run probe now checks that the slim image's own user can read PG_VERSION and fails fast with remediation (stop --no-backup to reset, or unset the flag) when it cannot. Also documents the flag in the SIDE_EFFECTS of db pull, services, and the declarative schema commands, and records why the deno1 edge-runtime tag check intentionally also covers an explicit pin of that tag. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 429bad2c79
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…slim contract The slim entrypoint runs a temporary server during first-boot init, so the slim specs' healthcheck now requires PID 1 to be the final postgres process before pg_isready counts (same gate the stack's docker path uses); docker.io keeps the plain pg_isready test byte-identically. The pg_dump one-shot runner (db dump, db pull, migration squash) now overrides the entrypoint to bash on slim refs — the slim entrypoint would otherwise initdb an empty cluster and hand the dump command to postgres. Also rewords a settings-renderer comment off Go-authority framing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89b4e15a33
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…t coupling Postgres must write postmaster.pid and WAL under PGDATA, so the reused-volume guard now also requires write access (test -w on the mount) — a read-only- accessible volume previously slipped past the guard into the same crash-loop it exists to prevent. The error and probe naming follow (Inaccessible / AccessibleToImage). The new integration tests narrow errors with instanceof on the exported classes instead of asserting the _tag field through casts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 235924d28f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…y resolver The legacy resolver and the functions-path edgeRuntimeImage read the same .temp/edge-runtime-version pin but disagreed under the slim flag: a stale v1.68.4 pin (left by an earlier deno_version = 1 run) tag-swapped onto the slim base yields an unpullable ref, since no slim build of that tag exists. Both resolvers now apply the same docker.io exception from one shared constant. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Summary
Adds an opt-in env feature flag
SUPABASE_USE_SLIM_IMAGES("true"or"1", read from the ambient process env per call) that makes the legacy shell resolve its local-stack Docker images from the slimghcr.io/supabase/cli/<service>builds instead of the docker.io images pinned in the embedded Dockerfile manifest — so the slim images can be exercised through the stable CLI. With the flag unset, behavior is byte-identical.Commit 1 — flag plumbing
apps/cli/src/shared/services/slim-images.tsowns the gate and the pure translation: Dockerfile alias → stack-catalog service, keeping the Dockerfile's pinned version translated into the slim tag scheme viadockerImageForServicefrom a new lightweight@supabase/stack/versionsexport (supavisor:2.9.7→pooler:v2.9.7,logflare:1.50.4→analytics:v1.50.4, vector's docker.io-only-alpinesuffix stripped).dockerfileServiceImage(alias)is the single flag-translated choke point for default images;dockerfileServiceImageRawremains for identity contracts. Pinned-version paths (legacyResolvePinnedImage,serviceslistings,gen types) go through the catalog so tag-scheme differences normalize correctly.SUPABASE_INTERNAL_IMAGE_REGISTRY/ECR mirror rewrite entirely (single pull candidate) — they are published only atghcr.io/supabase/cli, so any rewrite would silently pull the non-slim mirror.Commit 2 — slim postgres container support (start + shadow)
The slim postgres image has a different runtime contract from docker.io (non-root uid 65532, its own
entry.sh, postgres under/opt/postgres, nodocker-entrypoint.sh). When the resolved ref is slim, the main-db and shadow-db specs switch to it:entry.shself-initializes on first boot (initdb, config, bundled supabase migrations) and passes container argv through to postgres, so[db.settings]travel as-c key=valueargv pairs.schema.sql+webhook.sql+_supabase.sql) and the deterministic pgsodium root key are staged via the existing secret-filedocker cp; the image's bundledmigrate.shexecutes/etc/postgresql.schema.sqlas its first-boot postinit — the same hook the docker.io image runs — giving exactly-once semantics across container restarts with no CLI-side marker.PGSODIUM_KEY_FILEpoints the image's getkey script at the CLI's root key.start --from-backuprefuses a slim resolved ref with a typed, classified error until the restore flow learns the slim contract (a registry override landing back on docker.io still restores).db start: healthy container, settings applied via argv, all three schema templates present exactly once across restarts, root key loaded, shadow spec exercised by hand.Deliberately unchanged even with the flag on
differ/migra/pgprovejob images (no slim builds)deno_version = 1edge-runtime image (supabase/edge-runtime:v1.68.4)status/--excludeshort names andservicesimage overridesReviewer notes
supabase/.envare not honored. SIDE_EFFECTS.md rows were added for every command whose image resolution the flag reaches.supautils.*GUCs, socreate extension pg_netfails — this blocksdb diff/declarative shadow flows andstartwith[experimental.webhooks] enableduntil slim-services fixes itspostgresql.conftemplate allowlist.Linked issue
Closes #
open-for-contributionlabel (or I'm a Supabase maintainer).Checklist
fix(cli): …).pnpm check:allandpnpm testpass for the workspace(s) I touched.🤖 Generated with Claude Code