docs(cli): document SUPABASE_USE_SLIM_IMAGES side effects - #6383
docs(cli): document SUPABASE_USE_SLIM_IMAGES side effects#6383avallete wants to merge 5 commits into
Conversation
avallete
changed the title
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@aebe9e5659ef370fc00fd42bfccb9b9214ebec0cPreview package for commit |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46f10dd3ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | `PGDELTA_NPM_REGISTRY` | legacy opt-out's scoped npm registry | no | | ||
| | `SUPABASE_SSL_DEBUG` | migra SSL debug logging | no | | ||
| | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | overrides the differ's / shadow's image registry (shell **or** project `.env`, applied for the run via `legacyApplyProjectEnv`, matching `db push`/`db pull`/`db dump`) | no | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolves the shadow/pg-meta images from the slim `ghcr.io/supabase/cli/<service>` builds (`true`/`1` enable); the differ image has no slim build and stays on docker.io | no | |
There was a problem hiding this comment.
The db diff implementation never launches a pg-meta image: diff.handler.ts resolves a Postgres image for the shadow, while the pgAdmin path launches the separate differ image. Describing this as “shadow/pg-meta images” incorrectly expands the command's documented subprocess surface; identify the slim image as the shadow Postgres image instead.
AGENTS.md reference: apps/cli/AGENTS.md:L277-L279
Useful? React with 👍 / 👎.
| | `SUPABASE_ACCESS_TOKEN` | `--linked` auth | | ||
| | `BITBUCKET_CLONE_DIR` | (no-op for dump — no `--security-opt` is set) | | ||
| | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | rewrite the pg image registry | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolve the pg image from the slim `ghcr.io/supabase/cli` builds | |
There was a problem hiding this comment.
When db.major_version is 13, 14, or 15, an OrioleDB version is configured, or .temp/postgres-version contains a historical pin, legacyResolveDbImage deliberately returns a docker.io image even with this flag enabled. This row currently promises a slim pg image for all dump configurations, so it should list the same fallback and historical-pin exceptions documented for db start.
AGENTS.md reference: apps/cli/AGENTS.md:L277-L279
Useful? React with 👍 / 👎.
| | `SUPABASE_PROJECT_ID` | optional project ref fallback; also read from project dotenv now (previously ambient-shell-only) | no | | ||
| | `SUPABASE_ENV` | selects environment-specific dotenv files (`.env.<env>.local`, `.env.<env>`) | no (defaults to `development`) | | ||
| | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the Functions bundler image registry; read from the ambient shell **or** project dotenv; unset resolves ECR->GHCR->Docker-Hub candidates in order instead of a single URL | no | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolves the Functions bundler image from the slim `ghcr.io/supabase/cli/edge-runtime` build (`true`/`1` enable); ambient shell only, unlike the neighboring registry override | no | |
There was a problem hiding this comment.
For Docker bundling with edge_runtime.deno_version = 1 or a historical .temp/edge-runtime-version pin, edgeRuntimeImage intentionally keeps the docker.io image because only the current Dockerfile pin is slim-translated. This unconditional description therefore misdocuments those supported deploy configurations; add both exceptions as the neighboring Functions documentation does.
AGENTS.md reference: apps/cli/AGENTS.md:L277-L279
Useful? React with 👍 / 👎.
8e990da to
2e9fa99
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2e9fa99f36
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | ||
| | `SUPABASE_ACCESS_TOKEN` | auth token for Management API linked-version checks | no (falls back to keyring, then `~/.supabase/access-token`) | | ||
| | `SUPABASE_PROFILE` | built-in profile name or YAML file path | no (falls back to `~/.supabase/profile` -> `supabase`) | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | rewrites the local `LOCAL` column's image references to the slim `ghcr.io/supabase/cli/<service>` builds (`true`/`1` enable) | no | |
There was a problem hiding this comment.
When SUPABASE_USE_SLIM_IMAGES is enabled, toServiceVersionRow splits the resolved image so the ghcr.io/supabase/cli/<service> repository appears in SERVICE IMAGE (the structured name field), while LOCAL contains only the version tag. Saying the flag rewrites the LOCAL column therefore misdescribes every output format; name the SERVICE IMAGE/name field instead.
AGENTS.md reference: apps/cli/AGENTS.md:L359-L366
Useful? React with 👍 / 👎.
| | `SUPABASE_DB_MAJOR_VERSION` / `SUPABASE_DB_HEALTH_TIMEOUT` / `SUPABASE_DB_SETTINGS_*` | shadow container-config overrides, same as `db start`/`db reset` | no | | ||
| | `SUPABASE_PROJECT_ID` | overrides the shadow container's project id/labels, same as `db start`/`db reset` (`utils.DbId`); ALSO the linked-ref resolution fallback `--project-ref` supersedes — see Notes for the narrower scope of the flag | no | | ||
| | `SUPABASE_NETWORK_ID` (`--network-id`) | forces the shadow container/network onto an existing Docker network | no | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolves the shadow Postgres and `pg_dump` container images from the slim `ghcr.io/supabase/cli` builds instead of the docker.io Dockerfile pins (`true`/`1` enable) | no | |
There was a problem hiding this comment.
For an initial pull or shadow using PostgreSQL 13/14/15, an OrioleDB version, or a historical .temp/postgres-version pin, both paths ultimately use legacyResolveDbImage, which deliberately returns a docker.io image even when this flag is enabled. This unconditional row therefore misdocuments supported pull configurations; list the same fallback and historical-pin exceptions as db start.
AGENTS.md reference: apps/cli/AGENTS.md:L359-L366
Useful? React with 👍 / 👎.
| | `PGDELTA_DEBUG` | bundled-engine debug artifacts | no | | ||
| | `SUPABASE_SERVICES_HOSTNAME` | local DB host for the bootstrap generate | no | | ||
| | `DOCKER_HOST` | tcp daemon host used as the local DB host fallback | no | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolves both scoped shadow Postgres containers (bundled engine) / the shadow's platform-baseline container (legacy opt-out) from the slim `ghcr.io/supabase/cli` builds instead of the docker.io Dockerfile pins (`true`/`1` enable) | no | |
There was a problem hiding this comment.
When the project selects PostgreSQL 13/14/15, OrioleDB, or a historical .temp/postgres-version pin, the shadow resolvers named here keep their docker.io images rather than resolving all containers to slim builds. Add those exceptions here and to the analogous generate/SIDE_EFFECTS.md row so the declarative compatibility checklists match legacyResolveDbImage and resolvePostgresImage.
AGENTS.md reference: apps/cli/AGENTS.md:L359-L366
Useful? React with 👍 / 👎.
| | `SUPABASE_ENV` | Docker-unbundle path: selects environment-specific dotenv files (`.env.<env>.local`, `.env.<env>`) | no (defaults to `development`) | | ||
| | `BITBUCKET_CLONE_DIR` | Docker-unbundle path: when set, skips creating the named Deno-cache volume and omits its bind mount from the `docker run` command (Bitbucket's restricted Docker environment rejects both) | no | | ||
| | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | selects the registry the edge-runtime unbundle image is pulled from (`legacyGetRegistryImageUrl`); read from the ambient shell **or** project dotenv (Docker-unbundle path); unset resolves ECR->GHCR->Docker-Hub candidates in order instead of a single URL — also consumed on the `--use-api` invocation even though it never pulls an image | no (defaults to `public.ecr.aws`) | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | Docker-unbundle path: resolves the edge-runtime unbundle image from the slim `ghcr.io/supabase/cli/edge-runtime` build (`true`/`1` enable); `deno_version = 1` keeps its docker.io image | no | |
There was a problem hiding this comment.
On the Docker-unbundle path, a historical .temp/edge-runtime-version pin is passed through edgeRuntimeImage to slimImageForCurrentPin, which intentionally leaves it on docker.io because historical slim tags are unpublished. This row lists only the deno_version = 1 exception and thus promises a slim image for another supported configuration; document the historical-pin exception here and in the analogous functions serve row.
AGENTS.md reference: apps/cli/AGENTS.md:L359-L366
Useful? React with 👍 / 👎.
2e9fa99 to
db7e864
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db7e86446d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | `SUPABASE_EXPERIMENTAL_PG_DELTA` | enables the legacy opt-out's catalog cache when `[experimental.pgdelta].enabled` is unset, read project-`.env`-aware | no | | ||
| | `SUPABASE_USE_PG_DELTA_NEXT` | set to `false` for legacy catalog warming, read project-`.env`-aware | no | | ||
| | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | legacy opt-out's edge-runtime image registry, read project-`.env`-aware | no | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolves the legacy opt-out's edge-runtime image from the slim `ghcr.io/supabase/cli/edge-runtime` build (`true`/`1` enable); `deno_version = 1` keeps its docker.io image | no | |
There was a problem hiding this comment.
When the legacy pg-delta opt-out runs with a historical <workdir>/supabase/.temp/edge-runtime-version pin, legacyResolveEdgeRuntimeImage deliberately keeps the image on docker.io because only the current Dockerfile tag is slim-translated. This row exempts only deno_version = 1, so it incorrectly promises a slim image for another supported bootstrap configuration; add the historical-pin exception here as well.
AGENTS.md reference: apps/cli/AGENTS.md:L359-L366
Useful? React with 👍 / 👎.
Record the ambient flag on every legacy command whose image resolution it reaches, so the compatibility checklists match the resolver. Co-authored-by: Cursor <cursoragent@cursor.com>
Published slim images now match docker.io for postgres/storage/auth/ edge-runtime, so SIDE_EFFECTS no longer claim docker.io-only pg-delta jobs or slim-only one-shot argv. Co-authored-by: Cursor <cursoragent@cursor.com>
The resolver reads process.env per call and the project-dotenv installers do not copy this key, so a value set only in supabase/.env is ignored. Co-authored-by: Cursor <cursoragent@cursor.com>
Slim Vector now uses the same Logflare-wait heredoc as docker.io. Co-authored-by: Cursor <cursoragent@cursor.com>
Healthchecks now match docker.io except elixir wget; analytics keeps the image entrypoint. Co-authored-by: Cursor <cursoragent@cursor.com>
db7e864 to
aebe9e5
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aebe9e5659
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | `SUPABASE_EXPERIMENTAL_PG_DELTA` | enables the migrations-catalog cache when `[experimental.pgdelta].enabled` is unset | no (project `.env` or shell) | | ||
| | `SUPABASE_USE_PG_DELTA_NEXT` | selects the pg-delta implementation; `false` selects the legacy edge-runtime engine and thereby restores the migrations-catalog cache warmup (unset/unrecognized defaults to the next engine, which skips it); shell presence wins over project `.env`, even an empty shell value | no (project `.env` or shell) | | ||
| | `SUPABASE_INTERNAL_IMAGE_REGISTRY` | overrides the pg-delta edge-runtime image registry for the cache export | no (project `.env` or shell) | | ||
| | `SUPABASE_USE_SLIM_IMAGES` | resolves the pg-delta edge-runtime image from the slim `ghcr.io/supabase/cli/edge-runtime` build (`true`/`1` enable); `deno_version = 1` keeps its docker.io image | no (ambient shell only) | |
There was a problem hiding this comment.
When db push performs the legacy pg-delta cache export with a historical supabase/.temp/edge-runtime-version pin, legacyResolveEdgeRuntimeImage deliberately keeps the docker.io image because historical slim tags are unpublished. This row lists only deno_version = 1 as an exception and therefore promises a slim image for another supported configuration; add the historical-pin exception here and to the analogous db reset row.
AGENTS.md reference: apps/cli/AGENTS.md:L359-L366
Useful? React with 👍 / 👎.
1 participant
Summary
Records
SUPABASE_USE_SLIM_IMAGESon every legacy command whose image resolution the flag reaches, soSIDE_EFFECTS.mdmatches the resolver. Docs describe the current rewrite-only contract: slim postgres/storage/auth/edge-runtime match docker.io, Kong and job images stay on docker.io, and the pg-delta edge-runtime script runner now follows the same slim-capable resolver.Stacked on #6382 so reviewers see a docs-only diff.
Linked issue
Closes #
open-for-contributionlabel (or I'm a Supabase maintainer).Checklist
fix(cli): …).pnpm check:allpasses; relevant package tests pass for every touched workspace, andpnpm types:checkpasses for each touched TypeScript workspace (or workspace declaring it).