mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
f7842cdeb7
* fix(docker): bake non_root prisma engines at /opt/prisma so migrations run offline for any uid The non_root image baked the prisma CLI and engines under /app/.cache and used the CLI's default (library) engine mode. Prisma stopped baking the library engine, so `prisma migrate deploy` fell back to downloading it at startup, which needs network egress and a writable cache. Under an arbitrary non-root uid (OpenShift restricted-v2), an air-gapped network, or a readOnlyRootFilesystem, that download fails and the proxy starts on an empty schema while every DB endpoint returns 500. The migration entrypoint exits 0 on that failure, so a default-uid `docker run` with network never surfaced it Bake to /opt/prisma, a fixed world-readable path no cache mount shadows, and pin PRISMA_CLI_PATH plus PRISMA_CLI_QUERY_ENGINE_TYPE=binary so the baked binary engine is used directly, matching Dockerfile and Dockerfile.database. A build-time guard asserts the binary query engine is present, so a future prisma change that stops baking it fails the image build instead of silently degrading migrations Adds docker/test_offline_migration.sh, run from image-scan, which migrates a fresh Postgres with no egress as a non-root uid and asserts the schema was created, the case a default-uid `docker run` with network cannot catch * test(docker): move the offline migration check into a gated pytest and stop pinning XDG_CACHE_HOME at the read-only bake The offline migration check lived in docker/ as a shell script. It now lives in tests/proxy_migration_tests/ as a pytest gated on LITELLM_IMAGE, matching the sibling schema-migration test gated on DATABASE_URL, and image-scan invokes it with pytest instead of bash. It also asserts the migration entrypoint's exit code alongside the table count, so a crash or a container-startup failure fails loudly rather than only surfacing as a low table count Runtime XDG_CACHE_HOME pointed at /opt/prisma/.cache, which is baked a+rX with no write, so any XDG-aware library writing a cache at runtime would be denied for every uid. Leave it unset so it falls back to $HOME/.cache (/app/.cache, created here and owned by the runtime uid), matching Dockerfile and Dockerfile.database which never pin XDG at runtime. A second test guards against a future edit pointing a cache or home var back at the read-only bake |
||
|---|---|---|
| .. | ||
| _test-unit-base.yml | ||
| auto_update_price_and_context_window.yml | ||
| auto_update_price_and_context_window_file.py | ||
| check-schema-sync.yml | ||
| check-ui-api-types.yml | ||
| check_duplicate_issues.yml | ||
| close_low_quality_prs.yml | ||
| codeql.yml | ||
| codspeed.yml | ||
| conventional-commits.yml | ||
| create-release-branch.yml | ||
| create-release.yml | ||
| create_daily_oss_agent_shin_branch.yml | ||
| create_daily_staging_branch.yml | ||
| guard-fork-dependencies.yml | ||
| guard-main-branch.yml | ||
| helm_unit_test.yml | ||
| image-scan.yml | ||
| issue-keyword-labeler.yml | ||
| label-component.yml | ||
| mutation-test.yml | ||
| osv-scan.yml | ||
| run_llm_translation_tests.py | ||
| scorecard.yml | ||
| stale.yml | ||
| sync-schema.yml | ||
| test-code-quality.yml | ||
| test-linting.yml | ||
| test-litellm-ui-build.yml | ||
| test-litellm-ui-lint.yml | ||
| test-litellm-ui-unit.yml | ||
| test-mcp.yml | ||
| test-model-map.yaml | ||
| test-rust.yml | ||
| test-semgrep.yml | ||
| test-terraform-provider.yml | ||
| test-unit-core-utils.yml | ||
| test-unit-documentation.yml | ||
| test-unit-enterprise-routing.yml | ||
| test-unit-integrations.yml | ||
| test-unit-llm-providers.yml | ||
| test-unit-misc.yml | ||
| test-unit-proxy-auth.yml | ||
| test-unit-proxy-db.yml | ||
| test-unit-proxy-endpoints.yml | ||
| test-unit-proxy-infra.yml | ||
| test-unit-proxy-legacy.yml | ||
| test-unit-responses-caching-types.yml | ||
| test_server_root_path.yml | ||
| triage_issue_with_llm.yml | ||
| triage_reconsider.yml | ||
| triage_rollout_heads_up.yml | ||
| weekly_load_anomaly.yml | ||
| zizmor.yml | ||