Conversation
Signed-off-by: Valery Piashchynski <piashchynski.valery@gmail.com>
rustatian
added
C-enhancement
📝 WalkthroughWalkthroughThis PR updates the project's build infrastructure and dependencies. It extends Docker ignore rules, optimizes the Dockerfile with improved layer caching and adds a non-root user with OCI metadata labels, and bumps the Go toolchain to 1.26.1 alongside multiple dependency updates. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip You can customize the high-level summary generated by CodeRabbit.Configure the |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2315 +/- ##
=======================================
Coverage 35.37% 35.37%
=======================================
Files 18 18
Lines 851 851
=======================================
Hits 301 301
Misses 511 511
Partials 39 39 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: Valery Piashchynski <piashchynski.valery@gmail.com>
There was a problem hiding this comment.
Pull request overview
Release PR for v2025.1.9, primarily updating Go dependencies (incl. grpc plugin) and adjusting the Docker build to improve caching and runtime hardening.
Changes:
- Bumped
github.com/roadrunner-server/grpc/v5tov5.3.0and refreshed multiple indirect deps for CVE remediation. - Updated Go module metadata and sums (including adding
doublestarfor globstar/brace expansion support via deps). - Refactored Dockerfile for better layer caching and to run as a non-root user; expanded
.dockerignore.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
go.mod |
Updates Go version directive and dependency versions (grpc plugin + CVE-related bumps). |
go.sum |
Updates module checksums to match dependency changes. |
Dockerfile |
Improves build caching, simplifies build steps, installs CA certs, and runs as non-root. |
.dockerignore |
Excludes additional repo files from Docker build context. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
45-53: Add WORKDIR for defensive hardening, but note default config does not require it.The final stage lacks an explicit
WORKDIRdirective (defaults to/), andUSER rrcannot write there. However, the default.rr.yamlconfig routes logs tostderrand usespipesfor relay—no writable filesystem paths are required. The risk only materializes if users enable the static middleware (dir: ".") or configure custom file-based logging/sockets without first setting a writable working directory. Adding the suggestedWORKDIR /appwith proper ownership remains good practice for security and to prevent misconfiguration errors when users customize the config.Suggested minimal hardening patch
# Non-root user RUN addgroup -S rr && adduser -S -G rr rr +RUN mkdir -p /app && chown rr:rr /app +WORKDIR /app # copy required files from builder image COPY --from=builder /src/rr /usr/bin/rr COPY --from=builder /src/.rr.yaml /etc/rr.yaml USER rr🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 45 - 53, Add a writable working directory for the non-root USER to prevent misconfigurations: create and set WORKDIR /app in the final stage and ensure the directory is owned by the rr user (mkdir -p /app and chown rr:rr /app) before switching to USER rr; reference the Dockerfile directives USER rr, WORKDIR, COPY --from=builder /src/.rr.yaml and the .rr.yaml config when making this change so the image remains secure and writable if users enable file-based middleware or logging.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@Dockerfile`:
- Around line 45-53: Add a writable working directory for the non-root USER to
prevent misconfigurations: create and set WORKDIR /app in the final stage and
ensure the directory is owned by the rr user (mkdir -p /app and chown rr:rr
/app) before switching to USER rr; reference the Dockerfile directives USER rr,
WORKDIR, COPY --from=builder /src/.rr.yaml and the .rr.yaml config when making
this change so the image remains secure and writable if users enable file-based
middleware or logging.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8d1fd3a6-0411-4cbd-a7d6-e5741043af1d
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (3)
.dockerignoreDockerfilego.mod
Reason for This PR
Description of Changes
🚀 v2025.1.9 🚀
Changelog
📦
grpcplugin**(globstar/recursive) and brace expansion{pattern1,pattern2}ingrpc.protoconfiguration paths FR (thanks @Nyholm)🎯 Core
1.26.1to address CVE-2026-25679, CVE-2026-27142, CVE-2026-27137 ingo/stdlibCHORE (thanks @Orrison)License Acceptance
By submitting this pull request, I confirm that my contribution is made under the terms of the MIT license.
PR Checklist
[Author TODO: Meet these criteria.][Reviewer TODO: Verify that these criteria are met. Request changes if not]git commit -s).CHANGELOG.md.Summary by CodeRabbit
Chores