Skip to content

fix/update-dockerfile #1596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KambleSahil3 merged 6 commits into from
Apr 1, 2026
Merged

fix/update-dockerfile #1596

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c8f4c15
feat: udpate dockerfile for migration
KambleSahil3 Mar 31, 2026
c38b6a5
feat: udpate dockerfiles for migration
KambleSahil3 Apr 1, 2026
378ea2a
fix: migration issue in Dockerfile
KambleSahil3 Apr 1, 2026
29a4749
fix: migration issue give write access to only prisma folder
KambleSahil3 Apr 1, 2026
0e75183
fix: migration issue in Dockerfile remove prisma generate from CMD
KambleSahil3 Apr 1, 2026
4a32393
fix: Update seed dockerfile and scripts for AFJ
KambleSahil3 Apr 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfiles/Dockerfile.agent-service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,4 +33,4 @@ COPY --from=build /app/dist/apps/agent-service/ ./dist/apps/agent-service/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/agent-service/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deployy && cd ../.. && node dist/apps/agent-service/main.js"]
2 changes: 1 addition & 1 deletion Dockerfiles/Dockerfile.api-gateway
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/api-gateway/ ./dist/apps/api-gateway/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/api-gateway/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/api-gateway/main.js"]
2 changes: 1 addition & 1 deletion Dockerfiles/Dockerfile.cloud-wallet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/cloud-wallet/ ./dist/apps/cloud-wallet/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/cloud-wallet/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/cloud-wallet/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.connection
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/connection/ ./dist/apps/connection/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/connection/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/connection/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.ecosystem
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/ecosystem/ ./dist/apps/ecosystem/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/ecosystem/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/ecosystem/main.js"]
Comment on lines 25 to +26

@coderabbitai coderabbitai Bot Apr 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Permission mismatch: non-root user cannot run migrations.

The USER nextjs directive (Line 25) conflicts with the CMD running npx prisma migrate deploy (Line 26). The ecosystem service in docker-compose-dev.yml does not specify user: root, unlike agent-provisioning and agent-service. This will cause permission failures at container startup.

Either add user: root to the ecosystem service in docker-compose-dev.yml, or restructure to run migrations separately before starting the service.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfiles/Dockerfile.ecosystem` around lines 25 - 26, The Dockerfile sets
USER nextjs but the CMD runs "npx prisma migrate deploy", causing permission
errors because migrations require root; fix by either (A) making the ecosystem
service run migrations as root by adding user: root to the ecosystem service in
docker-compose-dev.yml so the existing CMD succeeds, or (B) remove migrations
from the container start and run them separately (e.g., run npx prisma migrate
deploy in a dedicated init container or CI step) and leave USER nextjs in the
Dockerfile; target the Dockerfile USER nextjs and the CMD "npx prisma migrate
deploy" as the symbols to change, or update the ecosystem service in
docker-compose-dev.yml to include user: root.

4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.geolocation
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/geo-location/ ./dist/apps/geo-location/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/geo-location/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/geo-location/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.issuance
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/issuance/ ./dist/apps/issuance/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/issuance/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/issuance/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.ledger
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/ledger/ ./dist/apps/ledger/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/ledger/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/ledger/main.js"]
2 changes: 1 addition & 1 deletion Dockerfiles/Dockerfile.notification
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@ COPY --from=build /app/dist/apps/notification/ ./dist/apps/notification/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/notification/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/notification/main.js"]
2 changes: 1 addition & 1 deletion Dockerfiles/Dockerfile.oid4vc-issuance
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,4 @@ COPY --from=build /app/dist/apps/oid4vc-issuance/ ./dist/apps/oid4vc-issuance/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/oid4vc-issuance/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/oid4vc-issuance/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.oid4vc-verification
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/oid4vc-verification/ ./dist/apps/oid4vc-verific
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/oid4vc-verification/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/oid4vc-verification/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.organization
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/organization/ ./dist/apps/organization/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/organization/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/organization/main.js"]
2 changes: 1 addition & 1 deletion Dockerfiles/Dockerfile.seed
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,4 @@ RUN pnpm i --frozen-lockfile --ignore-scripts \
&& cd libs/prisma-service && npx prisma generate \
&& chown -R nextjs:nodejs /app
USER nextjs
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma db seed"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma db seed"]

@coderabbitai coderabbitai Bot Apr 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Find all startup commands that run prisma migrate deploy =="
rg -n --no-heading 'prisma migrate deploy' Dockerfiles docker-compose.yml docker-compose-dev.yml

echo
echo "== Inspect seed service block for startup ordering constraints =="
rg -n -A20 -B2 '^  seed:' docker-compose.yml

echo
echo "== Inspect api-gateway block for migration overlap context =="
rg -n -A20 -B2 '^  api-gateway:' docker-compose.yml

Repository: credebl/platform

Length of output: 4835

Serialize Prisma migrations with a dedicated init service instead of distributing across all containers.

Line 16 adds prisma migrate deploy to the seed service, but this compounds a systemic issue: nearly 20 services (api-gateway, user, utility, organization, webhook, verification, x509, issuance, notification, ledger, ecosystem, connection, geolocation, oid4vc-issuance, oid4vc-verification, cloud-wallet, agent-provisioning, agent-service, and seed) all run migrations independently at startup. The docker-compose.yml seed service has no depends_on constraints, so migrations execute in parallel across containers with no coordination. This creates race conditions and lock contention, causing intermittent startup failures.

Move migrations to a separate initialization service that runs once before other containers start, then have all services depend on it via depends_on.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@Dockerfiles/Dockerfile.seed` at line 16, Remove the migration command from
the seed container CMD in Dockerfile.seed (the current CMD invoking "npx prisma
migrate deploy && npx prisma db seed") and instead create a dedicated one-shot
init service in docker-compose that runs "npx prisma migrate deploy" (followed
by "npx prisma db seed" if seeding is desired) so migrations run once; update
all application services (api-gateway, user, utility, organization, webhook,
verification, x509, issuance, notification, ledger, ecosystem, connection,
geolocation, oid4vc-issuance, oid4vc-verification, cloud-wallet,
agent-provisioning, agent-service, seed) to use depends_on on that new init
service to ensure serialized migrations before they start. Ensure the new init
service uses the same DB config as the app (same env/volumes/networks) and is
defined as a one-shot command (not restart: always) so it runs once and exits
successfully before dependent containers start.

4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.user
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/user/ ./dist/apps/user/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/user/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/user/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.utility
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/utility/ ./dist/apps/utility/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/utility/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/utility/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.verification
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/verification/ ./dist/apps/verification/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/verification/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/verification/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.webhook
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/webhook/ ./dist/apps/webhook/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/webhook/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/webhook/main.js"]
4 changes: 2 additions & 2 deletions Dockerfiles/Dockerfile.x509
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Stage 1: Build the application
FROM node:24-alpine3.21 AS build
RUN apk update && apk upgrade && apk add --no-cache openssl=3.3.6-r0 \
&& rm -rf /var/cache/apk/*
&& rm -rf /var/cache/apk/*
RUN npm install -g pnpm@9.15.3 --ignore-scripts
WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
Expand All @@ -23,4 +23,4 @@ COPY --from=build /app/dist/apps/x509/ ./dist/apps/x509/
COPY --from=build /app/libs/ ./libs/
COPY --from=build /app/node_modules ./node_modules
USER nextjs
CMD ["node", "dist/apps/x509/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && cd ../.. && node dist/apps/x509/main.js"]
2 changes: 1 addition & 1 deletion apps/agent-provisioning/AFJ/scripts/docker_start_agent.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ cat <<EOF >${CONFIG_FILE}
"walletPassword": "$WALLET_STORAGE_PASSWORD",
"walletAdminAccount": "$WALLET_STORAGE_USER",
"walletAdminPassword": "$WALLET_STORAGE_PASSWORD",
"walletScheme": "DatabasePerWallet",
"walletScheme": "ProfilePerWallet",
"indyLedger": $INDY_LEDGER,
"endpoint": [
"$AGENT_ENDPOINT"
Expand Down
2 changes: 1 addition & 1 deletion apps/agent-provisioning/AFJ/scripts/fargate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ cat <<EOF >$PWD/agent-provisioning/AFJ/agent-config/${AGENCY}_${CONTAINER_NAME}.
"walletPassword": "$WALLET_STORAGE_PASSWORD",
"walletAdminAccount": "$WALLET_STORAGE_USER",
"walletAdminPassword": "$WALLET_STORAGE_PASSWORD",
"walletScheme": "DatabasePerWallet",
"walletScheme": "ProfilePerWallet",
"indyLedger": $INDY_LEDGER,
"endpoint": [
"$INBOUND_ENDPOINT"
Expand Down
2 changes: 1 addition & 1 deletion apps/agent-provisioning/AFJ/scripts/on_premises_agent.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ cat <<EOF >${CONFIG_FILE}
"walletPassword": "$WALLET_STORAGE_PASSWORD",
"walletAdminAccount": "$WALLET_STORAGE_USER",
"walletAdminPassword": "$WALLET_STORAGE_PASSWORD",
"walletScheme": "DatabasePerWallet",
"walletScheme": "ProfilePerWallet",
"indyLedger": $INDY_LEDGER_FORMATTED,
"endpoint": [
"$AGENT_ENDPOINT"
Expand Down
2 changes: 1 addition & 1 deletion apps/agent-provisioning/AFJ/scripts/start_agent.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ cat <<EOF >"$CONFIG_FILE"
"walletPassword": "$WALLET_STORAGE_PASSWORD",
"walletAdminAccount": "$WALLET_STORAGE_USER",
"walletAdminPassword": "$WALLET_STORAGE_PASSWORD",
"walletScheme": "DatabasePerWallet",
"walletScheme": "ProfilePerWallet",
"indyLedger": $INDY_LEDGER,
"endpoint": [
"$AGENT_ENDPOINT"
Expand Down
2 changes: 1 addition & 1 deletion apps/agent-provisioning/AFJ/scripts/start_agent_ecs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ cat <<EOF >/app/agent-provisioning/AFJ/agent-config/${AGENCY}_${CONTAINER_NAME}.
"walletPassword": "$WALLET_STORAGE_PASSWORD",
"walletAdminAccount": "$WALLET_STORAGE_USER",
"walletAdminPassword": "$WALLET_STORAGE_PASSWORD",
"walletScheme": "DatabasePerWallet",
"walletScheme": "ProfilePerWallet",
"indyLedger": $INDY_LEDGER,
"endpoint": [
"$INBOUND_ENDPOINT"
Expand Down
41 changes: 38 additions & 3 deletions docker-compose-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ services:
- ./.env
environment:
- ROOT_PATH=$PWD/apps/agent-provisioning/AFJ/agent-config
user: root

@coderabbitai coderabbitai Bot Apr 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Running containers as root introduces security risks.

Same concern as docker-compose.yml: overriding USER nextjs to run as root negates non-root security benefits. Consider the architectural suggestions mentioned in the docker-compose.yml review to minimize root usage.

Also applies to: 155-155

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@docker-compose-dev.yml` at line 132, The docker-compose-dev.yml override uses
"user: root", which reintroduces root privileges; update the service entries
that set "user: root" to run as the non-root application user instead (e.g.,
match the Dockerfile's USER nextjs or use a UID:GID variable), and ensure the
corresponding Dockerfile or image creates and switches to that user (refer to
the "user: root" lines and the Dockerfile's "USER nextjs" declaration); if
host-volume permission requires it, prefer setting user: "${UID}:${GID}" via
environment substitution and document the needed UID/GID rather than using root.

volumes:
- $PWD/apps/agent-provisioning/AFJ/agent-config:/app/agent-provisioning/AFJ/agent-config
- /var/run/docker.sock:/var/run/docker.sock
Expand All @@ -151,6 +152,7 @@ services:
dockerfile: Dockerfiles/Dockerfile.agent-service
env_file:
- ./.env
user: root
volumes:
- /var/run/docker.sock:/var/run/docker.sock
volumes_from:
Expand Down Expand Up @@ -191,9 +193,42 @@ services:
dockerfile: Dockerfiles/Dockerfile.webhook
env_file:
- ./.env



ecosystem:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.ecosystem
env_file:
- ./.env
oid4vc-issuance:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.oid4vc-issuance
env_file:
- ./.env
oid4vc-verification:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.oid4vc-verification
env_file:
- ./.env
x509:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.x509
env_file:
- ./.env
Comment on lines +196 to +231

@coderabbitai coderabbitai Bot Apr 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Missing user: root for new services will cause startup failures.

The new services (ecosystem, oid4vc-issuance, oid4vc-verification, x509) are missing user: root, but their Dockerfiles:

  1. Declare USER nextjs (uid 1001) in the final stage
  2. Run npx prisma migrate deploy in CMD

This inconsistency with agent-provisioning and agent-service (which have user: root) will cause these four services to fail at startup with permission errors when attempting database migrations.

🔧 Proposed fix to add user: root 
   ecosystem:
     depends_on:
       - nats
       - api-gateway
     build:
       context: ./  # Adjust the context path as needed
       dockerfile: Dockerfiles/Dockerfile.ecosystem
     env_file:
       - ./.env
+    user: root
   oid4vc-issuance:
     depends_on:
       - nats
       - api-gateway
     build:
       context: ./  # Adjust the context path as needed
       dockerfile: Dockerfiles/Dockerfile.oid4vc-issuance
     env_file:
       - ./.env
+    user: root
   oid4vc-verification:
     depends_on:
       - nats
       - api-gateway
     build:
       context: ./  # Adjust the context path as needed
       dockerfile: Dockerfiles/Dockerfile.oid4vc-verification
     env_file:
       - ./.env
+    user: root
   x509:
     depends_on:
       - nats
       - api-gateway
     build:
       context: ./  # Adjust the context path as needed
       dockerfile: Dockerfiles/Dockerfile.x509
     env_file:
       - ./.env
+    user: root
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
ecosystem:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.ecosystem
env_file:
- ./.env
oid4vc-issuance:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.oid4vc-issuance
env_file:
- ./.env
oid4vc-verification:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.oid4vc-verification
env_file:
- ./.env
x509:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.x509
env_file:
- ./.env
ecosystem:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.ecosystem
env_file:
- ./.env
user: root
oid4vc-issuance:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.oid4vc-issuance
env_file:
- ./.env
user: root
oid4vc-verification:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.oid4vc-verification
env_file:
- ./.env
user: root
x509:
depends_on:
- nats
- api-gateway
build:
context: ./ # Adjust the context path as needed
dockerfile: Dockerfiles/Dockerfile.x509
env_file:
- ./.env
user: root
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@docker-compose-dev.yml` around lines 196 - 231, The four new service entries
(ecosystem, oid4vc-issuance, oid4vc-verification, x509) lack the user: root
setting, causing permission errors when their Dockerfiles switch to USER nextjs
and run npx prisma migrate deploy; update each service block to include user:
root (consistent with agent-provisioning and agent-service) so database
migrations run as root during container startup before the non-root user is
used.


volumes:
cache:
Expand Down
Loading
Loading