Containerize docs site tooling for security and update documentation - #4942
Merged
Conversation
Run Astro/Starlight dev, build, and preview commands through Docker (docs/Dockerfile, docker-compose.yml, service winutil-astro) instead of bare npm on the host, and document the required commands and rationale in docs/README.md.
Add a Dependency Installs, Builds, And Dev Servers section to AGENTS.md requiring docs/ tooling to run through Docker rather than directly on the host, point SPEC.md's Docs Site section at the new Dockerfile/docker-compose.yml, and renumber the remaining AGENTS.md sections to stay sequential.
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
github-actions
Bot
added
the
documentation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR adds Docker and Docker Compose support for the Astro documentation site. It updates documentation, project specifications, and agent instructions with containerized development and build workflows. ChangesDocumentation Docker tooling
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Developer
participant DockerCompose
participant Dockerfile
participant AstroDevServer
Developer->>DockerCompose: Start the documented Compose workflow
DockerCompose->>Dockerfile: Build the docs image
Dockerfile->>AstroDevServer: Install dependencies and start Astro
DockerCompose->>AstroDevServer: Mount source and expose port 4321
AstroDevServer-->>Developer: Serve the documentation site
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seanh1995
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/docker-compose.yml`:
- Line 8: Update the Docker Compose setup around the astro_node_modules volume
to ensure dependencies are refreshed when docs/package.json or
docs/package-lock.json changes. Add an appropriate dependency-volume sync step,
or document the required volume recreation workflow, while preserving the
existing /app/node_modules mount.
- Line 7: Update the docs compose bind mount around the service volume
configuration to avoid exposing the entire host docs directory, especially .env*
files, to package scripts. Mount only the required source and manifest paths
with appropriate read-only access for non-writable content, or revise the README
security claim to accurately reflect any remaining writable access.
- Line 5: Update the Docker Compose port mapping from "4321:4321" to
"127.0.0.1:4321:4321" so the service is published only on the host loopback
interface.
In `@docs/Dockerfile`:
- Around line 1-13: Update docs/Dockerfile to run the development command as the
non-root node user by adding USER node after ensuring /app and /app/node_modules
are owned by that user. Preserve the existing in-container npm install and
volume-mounted application workflow.
In `@docs/README.md`:
- Line 9: Label the fenced code block in the README with a text-compatible
language identifier, such as text or plaintext, so the markdownlint MD040 check
passes.
- Line 45: Update the documented winutil-astro preview command to include docker
compose run’s --service-ports option and pass --host 0.0.0.0 to the npm preview
script, ensuring the preview is reachable from outside the container.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cfa5d9fd-65fb-4fca-bf97-b5004dc18f9b
📒 Files selected for processing (6)
AGENTS.mdSPEC.mddocs/.dockerignoredocs/Dockerfiledocs/README.mddocs/docker-compose.yml
Tightened docs-container safety and clarified contributor workflow. The docs Docker image now switches to the non-root `node` user after setting ownership, and compose now binds Astro to `127.0.0.1` instead of all interfaces. Updated AGENTS and docs README instructions to explain the security boundary of the bind mount and to require rebuilding plus `docker compose down -v` after dependency changes so `node_modules` is reseeded correctly.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
AGENTS.md (1)
61-61: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low valueUpdate
docs/package-lock.jsonwhen changing dependencies.
docs/Dockerfilerunsnpm install, anddocs/docker-compose.ymlbind-mounts the source into/app. If that install modifiesnode_modules,npm installcan produce a newpackage-lock.json, but the guide currently only mentionsdocs/package.json. Require agents to updatedocs/package-lock.json, then rebuild the image and recreate the volume.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 61, Update the dependency guidance in AGENTS.md to require synchronizing docs/package-lock.json whenever docs/package.json changes, then retain the instructions to rebuild the winutil-astro image and recreate the node_modules volume so dependencies are installed from the updated lockfile.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Line 64: Update the secret-handling guidance in AGENTS.md: instruct users to
keep real secrets outside docs/ and not rely on docs/.dockerignore as a runtime
boundary. Specify that only the required secret should be explicitly mounted
into the container at runtime.
---
Nitpick comments:
In `@AGENTS.md`:
- Line 61: Update the dependency guidance in AGENTS.md to require synchronizing
docs/package-lock.json whenever docs/package.json changes, then retain the
instructions to rebuild the winutil-astro image and recreate the node_modules
volume so dependencies are installed from the updated lockfile.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 20f9ab8b-c9d7-42ea-9e7e-2aa8650f5865
📒 Files selected for processing (4)
AGENTS.mddocs/Dockerfiledocs/README.mddocs/docker-compose.yml
🚧 Files skipped from review as they are similar to previous changes (3)
- docs/Dockerfile
- docs/README.md
- docs/docker-compose.yml
Updates AGENTS.md to tighten docs security guidance: secrets must not be stored anywhere under `docs/`, because `docs/.dockerignore` only affects image build context and does not protect files from the Docker Compose bind mount used for docs dev/build commands.
The previous preview command didn't expose the port outside the container. Adding --service-ports and binding to 0.0.0.0 makes the preview server accessible from the host.
ChrisTitusTech
approved these changes
Aug 10, 2026
Owner
|
Looks good, my first reaction was oh no... he's gonna blow up my github workflows again, then I saw it was isolated into the docs folder and was like cool! haha. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type of Change
Description
This pull request introduces Docker-based containerization for the
docs/site and updates related documentation and project rules to require all npm-based tooling to run inside Docker, not on the host. This is a security-driven change to prevent supply-chain attacks and standardize the development environment. The most important changes are grouped below.Docs site containerization and workflow changes:
docs/Dockerfileanddocs/docker-compose.ymlto containerize the docs site, ensuring all npm/pnpm/yarn commands are run inside Docker (winutil-astroservice) instead of the host. [1] [2].dockerignoreto exclude build artifacts, environment files, and logs from the Docker build context for cleaner, safer images.docs/README.mdto document the new Docker-based workflow, removing old npm instructions and explaining the security rationale and command usage. [1] [2]Repository rules and documentation updates:
AGENTS.mdto require all dependency installs, builds, and dev server runs fordocs/to use Docker, never direct npm/pnpm/yarn on the host; clarified the process and rationale. Section numbers and related instructions were updated throughout. [1] [2] [3] [4] [5] [6] [7]SPEC.mdto reference the new Docker requirement for the docs site and point agents to the relevant section inAGENTS.md.These changes improve security, consistency, and clarity for all contributors working on the documentation site.
Issue related to PR