Skip to content

feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images #6329

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
avallete wants to merge 26 commits into from
Closed

feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images #6329

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
92576b1
feat(cli): add SUPABASE_USE_SLIM_IMAGES flag for slim ghcr images
avallete Aug 25, 2026
efba3aa
feat(cli): boot slim postgres images in legacy start and shadow flows
avallete Aug 25, 2026
cbb49da
Merge remote-tracking branch 'origin/develop' into avallete/supabase-…
avallete Aug 25, 2026
429bad2
fix(cli): guard slim postgres against docker.io-initialized volumes
avallete Aug 25, 2026
89b4e15
fix(cli): gate slim postgres readiness and one-shot dump jobs on the …
avallete Aug 25, 2026
235924d
fix(cli): probe write access on reused slim volumes and drop _tag tes…
avallete Aug 25, 2026
c030668
fix(cli): keep a deno1-tag edge-runtime pin on docker.io in the legac…
avallete Aug 25, 2026
3ab10e1
fix(cli): adapt start runtime contracts for slim distroless images
avallete Aug 26, 2026
9e7b854
test(cli): isolate slim healthcheck flag gating from ambient env
avallete Aug 26, 2026
9b00b95
fix(cli): skip slim realtime one-shot migrate job
avallete Aug 26, 2026
29b411e
fix(cli): run slim edge-runtime from /tmp and grant storage vector
avallete Aug 26, 2026
e13d34b
fix(cli): re-promote slim postgres as supabase_admin during initdb
avallete Aug 26, 2026
bcae499
fix(cli): mount slim storage volume at /home/nonroot
avallete Aug 26, 2026
01e32ba
fix(docker): bump supavisor from 2.9.7 to 2.9.10
avallete Aug 26, 2026
a83e369
fix(cli): keep shell jobs off distroless slim images and gate storage…
avallete Aug 26, 2026
587d56e
fix(docker): bump postgres from 17.6.1.165 to 17.6.1.166
avallete Aug 26, 2026
59e3368
fix(cli): drop the slim-only postgres postinit re-promotion
avallete Aug 27, 2026
94cd3a4
fix(cli): make the pooler start and fit under slim images
avallete Aug 27, 2026
691ff6b
fix(cli): keep image transformation on under slim storage, bump stora…
avallete Aug 27, 2026
0bede57
fix(cli): close slim-stack gaps against the published image contracts
avallete Aug 27, 2026
c0b20cd
fix(cli): make functions docker paths work with slim edge-runtime images
claude Aug 27, 2026
9b2bcba
ci(cli): temporary slim edge-runtime image validation workflow
claude Aug 28, 2026
2066df5
ci(cli): remove temporary slim edge-runtime validation workflow
claude Aug 28, 2026
ac136f0
fix(cli): refuse leftover slim volumes before create and pin the edge…
avallete Aug 28, 2026
be0af52
fix(cli): drop slim identity forks now that published images match do…
avallete Aug 28, 2026
6c57060
Merge branch 'develop' into avallete/supabase-slim-images-flag-c95c16
avallete Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions apps/cli-go/pkg/config/templates/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Exposed for updates by .github/dependabot.yml
FROM supabase/postgres:17.6.1.165 AS pg
FROM supabase/postgres:17.6.1.166 AS pg
Comment thread
avallete marked this conversation as resolved.
# Append to ServiceImages when adding new dependencies below
FROM library/kong:2.8.1 AS kong
FROM axllent/mailpit:v1.30.2 AS mailpit
Expand All @@ -9,11 +9,11 @@ FROM supabase/studio:2026.08.24-sha-8ec45b2 AS studio
FROM darthsim/imgproxy:v3.8.0 AS imgproxy
FROM supabase/edge-runtime:v1.74.3 AS edgeruntime
FROM timberio/vector:0.53.0-alpine AS vector
FROM supabase/supavisor:2.9.7 AS supavisor
FROM supabase/supavisor:2.9.10 AS supavisor
Comment thread
avallete marked this conversation as resolved.
FROM supabase/gotrue:v2.196.0 AS gotrue
FROM supabase/realtime:v2.129.9 AS realtime
FROM supabase/storage-api:v1.71.0 AS storage
FROM supabase/logflare:1.50.6 AS logflare
FROM supabase/realtime:v2.129.3 AS realtime
FROM supabase/storage-api:v1.72.1 AS storage
FROM supabase/logflare:1.50.4 AS logflare
Comment on lines +14 to +16

@github-actions github-actions Bot Aug 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 MAJOR · dependency-management · source: claude

The manifest downgrades Realtime and Logflare and leaves the stack catalog unsynchronized with all five changed service pins.

Evidence: Dockerfile:14 and :16 contain realtime v2.129.3 and logflare 1.50.4, whereas the diff removes v2.129.9 and 1.50.6. Dockerfile:2, :12, and :15 also change Postgres, Pooler, and Storage, but ServiceCatalog.ts still declares 17.6.1.165, 2.9.7, and v1.71.0 along with the removed Realtime/Logflare versions.

Suggested fix: Resolve whether the two downgrades are intentional, restore the current pins if not, and run the repository's sync:versions script so ServiceCatalog.ts matches the Dockerfile manifest.

# Append to JobImages when adding new dependencies below
FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
FROM supabase/migra:3.0.1663481299 AS migra
Expand Down
25 changes: 13 additions & 12 deletions apps/cli/src/legacy/commands/bootstrap/SIDE_EFFECTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,18 +69,19 @@ neither branch ever reaches the temp-login-role/Management-API path a passwordle

## Environment Variables

| Variable | Purpose | Required? |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------- | --------- |
| `SUPABASE_WORKDIR` | target dir (`--workdir` flag → env → prompt → cwd) | no |
| `SUPABASE_DB_PASSWORD` | DB password (`-p` flag → env → prompt/generate) | no |
| `GITHUB_TOKEN` | raise the GitHub API rate limit for template fetch | no |
| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login | no |
| `SUPABASE_PROFILE` | profile name/path (env → `~/.supabase/profile` → `supabase`) | no |
| `SUPABASE_YES` | auto-confirm the native push step's prompts, read project-`.env`-aware like the standalone `db push` | no |
| `SUPABASE_EXPERIMENTAL_PG_DELTA` | enables the legacy opt-out's catalog cache when `[experimental.pgdelta].enabled` is unset, read project-`.env`-aware | no |
| `SUPABASE_USE_PG_DELTA_NEXT` | set to `false` for legacy catalog warming, read project-`.env`-aware | no |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | legacy opt-out's edge-runtime image registry, read project-`.env`-aware | no |
| `PGDELTA_NPM_REGISTRY` | legacy opt-out's edge-runtime npm registry, read project-`.env`-aware | no |
| Variable | Purpose | Required? |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| `SUPABASE_WORKDIR` | target dir (`--workdir` flag → env → prompt → cwd) | no |
| `SUPABASE_DB_PASSWORD` | DB password (`-p` flag → env → prompt/generate) | no |
| `GITHUB_TOKEN` | raise the GitHub API rate limit for template fetch | no |
| `SUPABASE_ACCESS_TOKEN` | auth bypass for ensure-login | no |
| `SUPABASE_PROFILE` | profile name/path (env → `~/.supabase/profile` → `supabase`) | no |
| `SUPABASE_YES` | auto-confirm the native push step's prompts, read project-`.env`-aware like the standalone `db push` | no |
| `SUPABASE_EXPERIMENTAL_PG_DELTA` | enables the legacy opt-out's catalog cache when `[experimental.pgdelta].enabled` is unset, read project-`.env`-aware | no |
| `SUPABASE_USE_PG_DELTA_NEXT` | set to `false` for legacy catalog warming, read project-`.env`-aware | no |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | legacy opt-out's edge-runtime image registry, read project-`.env`-aware | no |
| `SUPABASE_USE_SLIM_IMAGES` | does not reach the legacy opt-out's edge-runtime image: it runs its script through an `sh -c` entrypoint the distroless slim build has no shell for, so it stays on docker.io | no |
Comment thread
avallete marked this conversation as resolved.
| `PGDELTA_NPM_REGISTRY` | legacy opt-out's edge-runtime npm registry, read project-`.env`-aware | no |

## Exit Codes

Expand Down
1 change: 1 addition & 0 deletions apps/cli/src/legacy/commands/db/diff/SIDE_EFFECTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,7 @@ of this command's own target resolve, ahead of the differ container.
| `PGDELTA_NPM_REGISTRY` | legacy opt-out's scoped npm registry | no |
| `SUPABASE_SSL_DEBUG` | migra SSL debug logging | no |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | overrides the differ's / shadow's image registry (shell **or** project `.env`, applied for the run via `legacyApplyProjectEnv`, matching `db push`/`db pull`/`db dump`) | no |
| `SUPABASE_USE_SLIM_IMAGES` | resolves the shadow/pg-meta images from the slim `ghcr.io/supabase/cli/<service>` builds (`true`/`1` enable); the differ image has no slim build and stays on docker.io | no |

`SUPABASE_DB_SHADOW_PORT`/`SUPABASE_NETWORK_ID`/`--network-id`/`SUPABASE_PROJECT_ID`/
`SUPABASE_DB_HEALTH_TIMEOUT` all apply to `--use-pgadmin` too — its shadow is provisioned
Expand Down
15 changes: 8 additions & 7 deletions apps/cli/src/legacy/commands/db/dump/SIDE_EFFECTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,14 @@ script run inside the local Postgres image to stdout or `--file`.

## Environment Variables

| Variable | Purpose |
| ----------------------------------------------------------------------------- | --------------------------------------------- |
| `SUPABASE_DB_PASSWORD` (`DB_PASSWORD` viper key; `--password`/`-p` overrides) | remote DB password |
| `SUPABASE_ACCESS_TOKEN` | `--linked` auth |
| `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry |
| `DOCKER_HOST` | docker daemon endpoint |
| Variable | Purpose |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| `SUPABASE_DB_PASSWORD` (`DB_PASSWORD` viper key; `--password`/`-p` overrides) | remote DB password |
| `SUPABASE_ACCESS_TOKEN` | `--linked` auth |
| `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry |
| `SUPABASE_USE_SLIM_IMAGES` | resolve the pg image from the slim `ghcr.io/supabase/cli` builds |
Comment thread
avallete marked this conversation as resolved.
| `DOCKER_HOST` | docker daemon endpoint |

## Exit Codes

Expand Down
1 change: 1 addition & 0 deletions apps/cli/src/legacy/commands/db/pull/SIDE_EFFECTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ baseline, so it is never cached.
| `SUPABASE_DB_MAJOR_VERSION` / `SUPABASE_DB_HEALTH_TIMEOUT` / `SUPABASE_DB_SETTINGS_*` | shadow container-config overrides, same as `db start`/`db reset` | no |
| `SUPABASE_PROJECT_ID` | overrides the shadow container's project id/labels, same as `db start`/`db reset` (`utils.DbId`); ALSO the linked-ref resolution fallback `--project-ref` supersedes — see Notes for the narrower scope of the flag | no |
| `SUPABASE_NETWORK_ID` (`--network-id`) | forces the shadow container/network onto an existing Docker network | no |
| `SUPABASE_USE_SLIM_IMAGES` | resolves the shadow Postgres and `pg_dump` container images from the slim `ghcr.io/supabase/cli` builds instead of the docker.io Dockerfile pins (`true`/`1` enable) | no |
| `SUPABASE_HOME` | overrides the `~/.supabase` root used for the shadow baseline cache (and other CLI state) | no |
| `SUPABASE_SHADOW_CACHE` | shadow baseline cache; opt-in (`1`/`true`); the shadow's post-baseline PGDATA is snapshotted to a tar and restored into the next run's fresh container (see Notes) | no |
| `SUPABASE_EXPERIMENTAL_PG_DELTA` | force pg-delta diff engine | no |
Expand Down
1 change: 1 addition & 0 deletions apps/cli/src/legacy/commands/db/push/SIDE_EFFECTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ before migrations unless `--skip-vault` is set.
| `SUPABASE_EXPERIMENTAL_PG_DELTA` | enables the migrations-catalog cache when `[experimental.pgdelta].enabled` is unset | no (project `.env` or shell) |
| `SUPABASE_USE_PG_DELTA_NEXT` | selects the pg-delta implementation; `false` selects the legacy edge-runtime engine and thereby restores the migrations-catalog cache warmup (unset/unrecognized defaults to the next engine, which skips it); shell presence wins over project `.env`, even an empty shell value | no (project `.env` or shell) |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | overrides the pg-delta edge-runtime image registry for the cache export | no (project `.env` or shell) |
| `SUPABASE_USE_SLIM_IMAGES` | does not reach the pg-delta edge-runtime image: the cache export delivers its script through an `sh -c` entrypoint the distroless slim build has no shell for, so that container stays on docker.io | no (ambient shell only) |
| `PGDELTA_NPM_REGISTRY` | overrides the pg-delta edge-runtime npm registry (`.npmrc` + `NPM_CONFIG_REGISTRY` forward) for the cache export | no (project `.env` or shell) |

## Exit Codes
Expand Down
1 change: 1 addition & 0 deletions apps/cli/src/legacy/commands/db/reset/SIDE_EFFECTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ the whole reset** (not just "skip buckets").
| `SUPABASE_EXPERIMENTAL_PG_DELTA` | enables the post-reset migrations-catalog cache (see Files Written) when `[experimental.pgdelta].enabled` is unset — distinct from `SUPABASE_EXPERIMENTAL_PGDELTA_ENABLED` above, which switches the reset's own apply branch instead | no (project `.env` or shell) |
| `SUPABASE_USE_PG_DELTA_NEXT` | selects the pg-delta implementation; `false` selects the legacy edge-runtime engine and thereby restores the migrations-catalog cache (unset/unrecognized defaults to the next engine, which skips it); shell presence wins over project `.env`, even an empty shell value | no (project `.env` or shell) |
| `SUPABASE_INTERNAL_IMAGE_REGISTRY` | overrides the pg-delta edge-runtime image registry for the migrations-catalog cache export (scoped for the whole run via `legacyApplyProjectEnv`, matching `db push`) | no (project `.env` or shell) |
| `SUPABASE_USE_SLIM_IMAGES` | does not reach the pg-delta edge-runtime image: the migrations-catalog cache export delivers its script through an `sh -c` entrypoint the distroless slim build has no shell for, so that container stays on docker.io | no (ambient shell only) |
Comment thread
avallete marked this conversation as resolved.
| `PGDELTA_NPM_REGISTRY` | overrides the pg-delta edge-runtime npm registry (`.npmrc` + `NPM_CONFIG_REGISTRY` forward) for the migrations-catalog cache export (scoped for the whole run via `legacyApplyProjectEnv`, matching `db push`) | no (project `.env` or shell) |
| `SUPABASE_DB_PORT` / `SUPABASE_DB_MAJOR_VERSION` / `SUPABASE_DB_HEALTH_TIMEOUT` / `SUPABASE_DB_SETTINGS_*` | local-path container-recreate config overrides, same as `db start` | no |
| `SUPABASE_NETWORK_ID` (`--network-id`) | forces the recreated container/network onto an existing Docker network | no |
Expand Down
Loading
Loading