From 2e5724d15009ee8d41e101d79c4aa6ea7494ba04 Mon Sep 17 00:00:00 2001 From: dev_agent Date: Fri, 2 Oct 2026 22:55:44 -0400 Subject: [PATCH] Fix review findings F1 and F2 for the Dockerfile and .dockerignore F1: derive the HEALTHCHECK port from MEALQUEST_HTTP_ADDR so an overridden listen port is still probed at /health. F2: make key/certificate exclusions recursive (**/*.pem, **/*.key) and add **/*.p12, **/*.pfx, **/*.jks, **/*.keystore so nested local secrets never enter the build context. Co-Authored-By: Claude Opus 5.5 --- .dockerignore | 8 ++++++-- Dockerfile | 4 +++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.dockerignore b/.dockerignore index 420c29b..3cbf0a8 100644 --- a/.dockerignore +++ b/.dockerignore @@ -16,5 +16,9 @@ bin/ .env* **/.env* deploy/secrets/ -*.pem -*.key +**/*.pem +**/*.key +**/*.p12 +**/*.pfx +**/*.jks +**/*.keystore diff --git a/Dockerfile b/Dockerfile index 8faa3d1..869a9d7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -32,6 +32,8 @@ ENV MEALQUEST_HTTP_ADDR=:8080 \ VOLUME /data EXPOSE 8080 USER 10001:10001 +# Probe the port from MEALQUEST_HTTP_ADDR (text after the last colon) so an +# overridden listen address stays healthy. HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ - CMD wget -q -O /dev/null http://127.0.0.1:8080/health || exit 1 + CMD wget -q -O /dev/null "http://127.0.0.1:${MEALQUEST_HTTP_ADDR##*:}/health" || exit 1 ENTRYPOINT ["/usr/local/bin/mealquest"]