From 731c549876acb95147788e1ee4d397e312ddcb2b Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Tue, 21 Apr 2026 15:30:42 -0700 Subject: [PATCH 1/2] [Fix] Docker: restore pre-uv Prisma cache path for /app/.cache mounts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The uv migration added PRISMA_BINARY_CACHE_DIR=/app/.cache/... and XDG_CACHE_HOME=/app/.cache to the runtime stages of Dockerfile and Dockerfile.database. BINARY_PATHS in the generated prisma client was baked to point into /app/.cache, so any deployment that mounts a volume there (common with securityContext.readOnlyRootFilesystem: true and an emptyDir/tmpfs for a writable cache) wipes the pre-downloaded query engine at pod startup, producing BinaryNotFoundError during connect(). Before the uv migration, prisma-python defaulted to $HOME/.cache = /root/.cache (runtime stage runs as root), which was unaffected by any /app/* volume mounts. Restore that behaviour: drop the env vars from the runtime stage, re-run prisma generate there so the query engine AND the baked BINARY_PATHS both land in /root/.cache, and remove the stale builder-stage /app/.cache (~800 MB). Dockerfile.non_root is intentionally left alone — its /app/.cache location is by design for the hardened offline-install flow. --- Dockerfile | 12 +++++++++--- docker/Dockerfile.database | 12 +++++++++--- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index a2cd1cb3ed2..0deddce3490 100644 --- a/Dockerfile +++ b/Dockerfile @@ -94,15 +94,21 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervi { apk del --no-cache npm 2>/dev/null || true; } WORKDIR /app -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - XDG_CACHE_HOME=/app/.cache \ - PATH="/app/.venv/bin:${PATH}" +ENV PATH="/app/.venv/bin:${PATH}" COPY --from=builder /app /app RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ find /app/.venv -type d -path "*/tornado/test" -delete +# Regenerate the Prisma client in the runtime stage so the baked-in +# BINARY_PATHS resolve to a location outside /app. Users with volume mounts +# that shadow /app/.cache (e.g. readOnlyRootFilesystem + emptyDir) would +# otherwise lose access to the pre-downloaded query engine at runtime. +# Drop the builder's /app/.cache afterwards — it's stale and adds ~800 MB +# the runtime doesn't use. +RUN rm -rf /app/.cache && prisma generate --schema=./schema.prisma + EXPOSE 4000/tcp COPY docker/supervisord.conf /etc/supervisord.conf diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database index 57ecef81eb8..1eebc26731d 100644 --- a/docker/Dockerfile.database +++ b/docker/Dockerfile.database @@ -92,15 +92,21 @@ RUN apk add --no-cache bash openssl tzdata nodejs npm python3 libsndfile supervi { apk del --no-cache npm 2>/dev/null || true; } WORKDIR /app -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - XDG_CACHE_HOME=/app/.cache \ - PATH="/app/.venv/bin:${PATH}" +ENV PATH="/app/.venv/bin:${PATH}" COPY --from=builder /app /app RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ find /app/.venv -type d -path "*/tornado/test" -delete +# Regenerate the Prisma client in the runtime stage so the baked-in +# BINARY_PATHS resolve to a location outside /app. Users with volume mounts +# that shadow /app/.cache (e.g. readOnlyRootFilesystem + emptyDir) would +# otherwise lose access to the pre-downloaded query engine at runtime. +# Drop the builder's /app/.cache afterwards — it's stale and adds ~800 MB +# the runtime doesn't use. +RUN rm -rf /app/.cache && prisma generate --schema=./schema.prisma + EXPOSE 4000/tcp COPY docker/supervisord.conf /etc/supervisord.conf From ce755048e52077f9690fcb5fc83ecb64efb5df4b Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Tue, 21 Apr 2026 15:46:47 -0700 Subject: [PATCH 2/2] Docker: drop env overrides from builder, COPY /root/.cache to runtime Follow-up on review feedback: the previous commit had the builder download the query engine into /app/.cache, then threw it away in the runtime stage and re-downloaded into /root/.cache. That doubled the build-time network fetch. Remove PRISMA_BINARY_CACHE_DIR and XDG_CACHE_HOME from the builder stage as well, so its prisma generate lands in /root/.cache with the correct path layout on its own. Drop the runtime-stage prisma generate and instead COPY --from=builder /root/.cache /root/.cache. Single download, smaller image. --- Dockerfile | 17 ++++++----------- docker/Dockerfile.database | 17 ++++++----------- 2 files changed, 12 insertions(+), 22 deletions(-) diff --git a/Dockerfile b/Dockerfile index 0deddce3490..d6c3bfad6f8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,10 +27,8 @@ RUN apk add --no-cache \ npm \ libsndfile -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - UV_PROJECT_ENVIRONMENT=/app/.venv \ +ENV UV_PROJECT_ENVIRONMENT=/app/.venv \ UV_LINK_MODE=copy \ - XDG_CACHE_HOME=/app/.cache \ PATH="/app/.venv/bin:${PATH}" # Copy dependency metadata first for layer caching @@ -97,18 +95,15 @@ WORKDIR /app ENV PATH="/app/.venv/bin:${PATH}" COPY --from=builder /app /app +# Prisma binaries live in $HOME/.cache (default prisma-python location), +# which is /root/.cache here. Copy them from the builder so they survive +# deployments that volume-mount /app/.cache (e.g. readOnlyRootFilesystem +# + emptyDir) — otherwise the mount would shadow the baked-in query engine. +COPY --from=builder /root/.cache /root/.cache RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ find /app/.venv -type d -path "*/tornado/test" -delete -# Regenerate the Prisma client in the runtime stage so the baked-in -# BINARY_PATHS resolve to a location outside /app. Users with volume mounts -# that shadow /app/.cache (e.g. readOnlyRootFilesystem + emptyDir) would -# otherwise lose access to the pre-downloaded query engine at runtime. -# Drop the builder's /app/.cache afterwards — it's stale and adds ~800 MB -# the runtime doesn't use. -RUN rm -rf /app/.cache && prisma generate --schema=./schema.prisma - EXPOSE 4000/tcp COPY docker/supervisord.conf /etc/supervisord.conf diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database index 1eebc26731d..585a81a2a71 100644 --- a/docker/Dockerfile.database +++ b/docker/Dockerfile.database @@ -26,10 +26,8 @@ RUN apk add --no-cache \ npm \ libsndfile -ENV PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \ - UV_PROJECT_ENVIRONMENT=/app/.venv \ +ENV UV_PROJECT_ENVIRONMENT=/app/.venv \ UV_LINK_MODE=copy \ - XDG_CACHE_HOME=/app/.cache \ PATH="/app/.venv/bin:${PATH}" # Copy dependency metadata first for layer caching @@ -95,18 +93,15 @@ WORKDIR /app ENV PATH="/app/.venv/bin:${PATH}" COPY --from=builder /app /app +# Prisma binaries live in $HOME/.cache (default prisma-python location), +# which is /root/.cache here. Copy them from the builder so they survive +# deployments that volume-mount /app/.cache (e.g. readOnlyRootFilesystem +# + emptyDir) — otherwise the mount would shadow the baked-in query engine. +COPY --from=builder /root/.cache /root/.cache RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \ find /app/.venv -type d -path "*/tornado/test" -delete -# Regenerate the Prisma client in the runtime stage so the baked-in -# BINARY_PATHS resolve to a location outside /app. Users with volume mounts -# that shadow /app/.cache (e.g. readOnlyRootFilesystem + emptyDir) would -# otherwise lose access to the pre-downloaded query engine at runtime. -# Drop the builder's /app/.cache afterwards — it's stale and adds ~800 MB -# the runtime doesn't use. -RUN rm -rf /app/.cache && prisma generate --schema=./schema.prisma - EXPOSE 4000/tcp COPY docker/supervisord.conf /etc/supervisord.conf