GeezerVison is showing github.com — feat(deployments): install deployed image base packages from a pinned Debian snapshot by myftija · Pull Request #4558 · triggerdotdev/trigger.dev
Conversation
myftija
commented
Aug 10, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
Every project's image contained a near-duplicate base-packages layer: apt-get against the live Debian archive bakes build-time archive state, so identical Containerfiles produced different ~30MB blobs and worker nodes cached one per project. The generated Containerfile now installs base packages from a pinned snapshot.debian.org archive and scrubs apt's timestamped files, making the layer a pure function of the base image and the pinned date: every project converges on one identical blob that nodes cache once.
Verified by building on two independent cold-cache builders, which produced identical digests for every layer.
Notes
- Default packages now install before user
instructions and pkgs, and user packages go in a separate sorted RUN, so customized projects still share the default layer. Instructions run with ca-certificates and git present and inherit the pinned sources.
- Base package versions freeze at the snapshot date and move forward with CLI releases; a test fails when the pin is over 90 days old, and the build asserts the base image codename matches the pinned suite with an error naming the escape hatch.
TRIGGER_BUILD_SKIP_APT_SNAPSHOT=1 falls back to the live archive. Documented in the aptGet extension docs, which now also note that version pins resolve against the snapshot.- Known limits: cold builds' archive dependency moves from the main Debian CDN to the best-effort snapshot.debian.org service (immutable and heavily CDN-cached, and mitigated by apt retries and the escape hatch, but a weaker SLA); builders that can only reach a private Debian mirror through
image.instructions need the escape hatch plus their own sources; layers created by extensions' own apt-get calls remain per-project.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
apt-get against the live archive made the package layer's content depend
on build time, so every project produced a near-duplicate blob that
worker nodes each had to cache separately. Pinning sources to a fixed
snapshot.debian.org timestamp and scrubbing apt's timestamped log and
cache files makes the layer a pure function of the base image and the
snapshot date, so it is byte-identical across projects. Default packages
install in their own layer before user instructions and packages, which
now go in a separate sorted RUN so customized projects keep sharing the
default layer. TRIGGER_BUILD_SKIP_APT_SNAPSHOT=1 falls back to the live
archive.
Assert the base image codename matches the pinned suite with an error
naming the escape hatch, scope archive trust to the Debian keyring with
signed-by, retry apt fetches, allow user pins of default packages to
downgrade past the already-installed version, repair dpkg state after
instructions when no user packages install, and bump the snapshot so
images carry the latest ca-certificates security update. A test now
fails when the pinned snapshot is over 90 days old, and the aptGet docs
note that packages resolve against the pinned snapshot.
🦋 Changeset detected
Latest commit: 94243ad
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 27 packages
| Name |
Type |
| trigger.dev |
Patch |
| @internal/dashboard-agent |
Patch |
| @trigger.dev/build |
Patch |
| @trigger.dev/core |
Patch |
| @trigger.dev/python |
Patch |
| @trigger.dev/react-hooks |
Patch |
| @trigger.dev/redis-worker |
Patch |
| @trigger.dev/rsc |
Patch |
| @trigger.dev/schema-to-json |
Patch |
| @trigger.dev/sdk |
Patch |
| @trigger.dev/database |
Patch |
| @trigger.dev/otlp-importer |
Patch |
| @trigger.dev/rbac |
Patch |
| @trigger.dev/sso |
Patch |
| @internal/cache |
Patch |
| @internal/clickhouse |
Patch |
| @internal/llm-model-catalog |
Patch |
| @internal/metrics-pipeline |
Patch |
| @internal/redis |
Patch |
| @internal/replication |
Patch |
| @internal/run-engine |
Patch |
| @internal/run-store |
Patch |
| @internal/schedule-engine |
Patch |
| @internal/testcontainers |
Patch |
| @internal/tracing |
Patch |
| @internal/tsql |
Patch |
| @internal/sdk-compat-tests |
Patch |
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
coderabbitai
Bot
commented
Aug 10, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
|
Walkthrough
Build image generation now installs base packages from pinned Debian snapshots by default. Default and user packages use separate installation layers for Bun and Node images. The build logic validates the Debian suite, configures APT retries, repairs broken dpkg state, and supports the TRIGGER_BUILD_SKIP_APT_SNAPSHOT=1 opt-out. Tests cover snapshot selection, package ordering, repair behavior, bypass behavior, and snapshot age. Documentation and a patch changeset describe the new behavior.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name |
Status |
Explanation |
| Docstring Coverage |
✅ Passed |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
| Linked Issues check |
✅ Passed |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check |
✅ Passed |
Check skipped because no linked issues were found for this pull request. |
| Title check |
✅ Passed |
The title clearly and concisely identifies the main change: installing deployed image base packages from a pinned Debian snapshot. |
| Description check |
✅ Passed |
The description clearly explains the change, testing, configuration behavior, documentation updates, and known limits, although it omits the template checklist and section headings. |
✨ Finishing Touches
📝 Generate docstrings
- Create stacked PR
- Commit on current branch
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Commit unit tests in branch
deterministic-apt-layer
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
myftija
changed the title
perf(cli): install deployed image base packages from a pinned Debian snapshot
feat(deployments): install deployed image base packages from a pinned Debian snapshot
Aug 10, 2026
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|