Skip to content

fix(docker): set NODE_ENV=production in the runner stage #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mudit-Lal merged 1 commit into from
Aug 19, 2026
Merged

fix(docker): set NODE_ENV=production in the runner stage #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions DEVALOK_FORK_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,9 @@ git remote add upstream https://github.com/documenso/documenso.git # one-time
git fetch upstream
git checkout -b chore/upstream-merge-<yymm>

# fork-only delta = workflow guards + this file. Capture it against the PREVIOUS sync base.
git diff <previous-sync-base> HEAD -- .github/workflows DEVALOK_FORK_NOTES.md > ../fork-delta.patch
# fork-only delta = workflow guards + this file + the Dockerfile NODE_ENV line.
# Capture it against the PREVIOUS sync base.
git diff <previous-sync-base> HEAD -- .github/workflows DEVALOK_FORK_NOTES.md docker/Dockerfile > ../fork-delta.patch

# working tree becomes upstream/main exactly (adds, mods AND deletes)
git read-tree -u --reset upstream/main
Expand Down Expand Up @@ -105,6 +106,15 @@ Expected open (intentional): `ci.yml/build_docker`, `codeql-analysis.yml/analyze
- `ci.yml` — only the `build_docker` job (Docker build = real prod signal). `build_app` job guarded above.
- `codeql-analysis.yml` — security scan (uses only `GITHUB_TOKEN`)

## Fork-local code changes

Keep this list short — every entry is a merge conflict waiting to happen. Anything here MUST be in the
`fork-delta.patch` capture above, or the next `read-tree` import silently drops it.

| File | Change | Why |
|---|---|---|
| `docker/Dockerfile` | `ENV NODE_ENV="production"` in the **runner** stage | Upstream never sets `NODE_ENV`, so self-hosters run React Router's *development* bundle and `useSecureCookies` (`packages/lib/constants/auth.ts`) stays false — session cookies get no `Secure` flag and no `__Secure-` prefix. **Must be runner-stage only**: as a Railway service variable it also reaches the build, where `npm ci` (installer stage) would omit devDependencies and break `turbo run build`. Worth upstreaming; until then it lives here. |

## Railway deploy

- Project: `documenso` (`9c5f62f8-2820-4ae0-862f-7c39db14e3f6`)
Expand Down
8 changes: 8 additions & 0 deletions docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,14 @@ FROM base AS runner
ENV HUSKY 0
ENV DOCKER_OUTPUT 1

# Devalok fork-local: upstream never sets NODE_ENV, so self-hosted instances run
# React Router's development bundle and `useSecureCookies` in
# packages/lib/constants/auth.ts stays false -- session cookies ship without the
# Secure flag and without the __Secure- prefix. Set here in the RUNNER stage only:
# as a build-time variable it would make `npm ci` (installer stage) omit
# devDependencies and break `turbo run build`.
ENV NODE_ENV="production"

# Telemetry credentials (baked into image at build time, can be disabled at runtime)
ARG NEXT_PRIVATE_TELEMETRY_KEY=""
ENV NEXT_PRIVATE_TELEMETRY_KEY="$NEXT_PRIVATE_TELEMETRY_KEY"
Expand Down
Loading