Narratives services image - #444
Open
ddebasmita-lab wants to merge 2 commits into
Open
Conversation
…s /agent
The repo had the agent sidecar but nothing to put in front of it: no container
served the React build, and nothing routed /agent/* to the sidecar. This adds
the second of the two containers in the Cloud Run service.
`Dockerfile` is a thin overlay on the upstream Custom Data Commons image. It
adds the compiled React app at /workspace/react-ui/ and replaces the nginx
config; the upstream entrypoint, which supervises nginx, Flask, Mixer, MCP and
the NL server, is left untouched.
The React build runs in a node stage inside the image rather than on the host.
That keeps a clean clone reproducible — `npm ci` installs exactly the tree in
package-lock.json — and avoids a pre-built dist/ having to be staged in first.
It also sidesteps .dockerignore, which excludes dist/ and would silently break
a host-staged copy.
`nginx.conf` routes:
/agent/* -> 127.0.0.1:5001, the sidecar. Buffering and caching are off
and chunked encoding is on, without which the chat stream
only arrives once the response closes.
/, /assets/* -> the React build, served from the image.
/core/api/* -> Mixer on :8081, with the CORS preflight it needs.
/mcp -> the MCP server on :8082.
everything else -> upstream Flask on :7070.
The bare-asset allowlist covers exactly the three files public/ ships —
loader.png, send.svg, logo.png — verified against `npm run build` output.
`build.sh` mirrors the reviewed shape of agent/build.sh: resolves its own
directory so the docker context does not depend on the caller's CWD, hoists the
image name into one variable, loops over "$@" rejecting unknown flags, offers
--help, and fails the build if the result is not amd64.
`.dockerignore` gains agent/ and config/, neither of which the React build
reads. The patterns match the context root only, so src/config/ is unaffected.
This image deliberately keeps upstream's runtime user rather than dropping to a
non-root one, unlike the agent sidecar. The reasoning is recorded in the
Dockerfile: the entrypoint supervises five processes and owns its filesystem
layout, and nothing this overlay adds needs write access at runtime.
… image Pinning `--platform=linux/amd64` on the FROM line trips BuildKit's FromPlatformFlagConstDisallowed warning and would break a multi-platform build. It was also redundant: build.sh already passes `--platform linux/amd64` and fails the build if the result is not amd64. Verified by building on an arm64 host: the image cross-builds cleanly, the arch check passes, and the warning is gone.
ddebasmita-lab
requested review from
beets,
juliawu and
nick-nlb
as code owners
August 17, 2026 17:31
Contributor
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Clear description of the changes.
Dockerfile — a thin overlay on the upstream Custom Data Commons image. Adds the compiled React app at /workspace/react-ui/ and replaces the nginx config; upstream's entrypoint, which supervises nginx, Flask, Mixer, MCP and the NL server, is left untouched.
The React build runs in a node stage inside the image rather than on the host. That keeps a clean clone reproducible — npm ci installs exactly the tree in package-lock.json — and avoids a pre-built dist/ having to be staged first. It also sidesteps .dockerignore, which excludes dist/ and would silently break a host-staged copy.
nginx.conf — routes: