GeezerVison is showing github.com — feat(cli): allow overriding the deploy base images per project by brentshulman-silkline · Pull Request #5003 · triggerdotdev/trigger.dev
Conversation
Closes #5002
Lets a project build its deploy image on its own base, such as a FIPS-validated or hardened Node image, in place of the published triggerdotdev/node / triggerdotdev/bun Debian bases.
export default defineConfig({
runtime: "node-26",
build: {
image: {
base: "registry.example.com/node-fips:26@sha256:…", // runtime (final) stage
buildBase: "registry.example.com/node:26-dev@sha256:…", // optional; build stage
},
},
});TRIGGER_BUILD_BASE_IMAGE and TRIGGER_BUILD_BUILD_IMAGE override the config, so a platform team can set the base for every project in CI.
What changes
@trigger.dev/core: build.image.{base,buildBase} on TriggerConfig, and the same two fields on BuildManifest.image. build.json records which base a deploy used.trigger.dev CLI: createBuildManifestFromBundle resolves the overrides (env first, then config). generateContainerfile falls back to BASE_IMAGE / BUILD_IMAGE when they're unset. Nothing changes for projects that don't set them.- Docs: a "Base image" section in
config/config-file that lists what a custom base must provide (node at the runtime major, the DEFAULT_PACKAGES, a node user, glibc), with a warning that image.pkgs and the apt-based extensions assume Debian.
Open questions
- Should the CLI error out when a custom base is combined with
image.pkgs or an apt extension, rather than leave it to the image owner?
- When a project has
image.instructions, the build stage is FROM base plus an apt-get toolchain install, which fails on a non-Debian base. Should buildBase replace that path too?
✅ Checklist
- I have followed every step in the contributing guide
- The PR title follows the convention.
- I ran and tested the code works
Testing
packages/cli-v3: vitest run src/deploy src/build (10 files, 132 tests) and pnpm run typecheck pass.- New tests:
generateContainerfile uses the configured base and build images on node and bun, and keeps the published build image when only base is set.resolveImageBaseOverrides covers precedence: env over config, and empty env vars count as unset.
oxfmt --check is clean on the changed packages.
Changelog
Deploys can use your own base images with build.image.base / build.image.buildBase in trigger.config.ts, or the TRIGGER_BUILD_BASE_IMAGE / TRIGGER_BUILD_BUILD_IMAGE environment variables.
Screenshots
N/A
💯
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Adds build.image.base and build.image.buildBase to trigger.config.ts, plus the
TRIGGER_BUILD_BASE_IMAGE and TRIGGER_BUILD_BUILD_IMAGE env vars, so deploys can
build on FIPS-validated or hardened images instead of the published Debian bases.
🦋 Changeset detected
Latest commit: 9b02208
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 28 packages
| Name |
Type |
| @trigger.dev/core |
Patch |
| trigger.dev |
Patch |
| @trigger.dev/build |
Patch |
| @trigger.dev/python |
Patch |
| @trigger.dev/redis-worker |
Patch |
| @trigger.dev/schema-to-json |
Patch |
| @trigger.dev/sdk |
Patch |
| @internal/clickhouse |
Patch |
| @internal/llm-model-catalog |
Patch |
| @internal/metrics-pipeline |
Patch |
| @trigger.dev/rbac |
Patch |
| @internal/redis |
Patch |
| @internal/replication |
Patch |
| @internal/run-engine |
Patch |
| @internal/run-store |
Patch |
| @internal/schedule-engine |
Patch |
| @internal/tracing |
Patch |
| @internal/webhook-engine |
Patch |
| @internal/webhook-sources |
Patch |
| @internal/dashboard-agent |
Patch |
| @internal/cache |
Patch |
| @trigger.dev/react-hooks |
Patch |
| @trigger.dev/rsc |
Patch |
| @trigger.dev/billing |
Patch |
| @trigger.dev/database |
Patch |
| @trigger.dev/otlp-importer |
Patch |
| @trigger.dev/sso |
Patch |
| @internal/testcontainers |
Patch |
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
coderabbitai
Bot
commented
Oct 5, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
|
Walkthrough
The build configuration and manifest schema now support optional base and buildBase image values. Environment variables can override the corresponding configuration values. Containerfile generation uses the selected images and retains the runtime defaults when no override is set. Documentation describes image requirements and Debian-base assumptions.
Priority: ➖ Normal
Severity of issue fixed: Medium
Merge Risk: 🟡 Moderate · up to 9b022
Projects combining image instructions with a separate build image can build with the wrong toolchain or fail deployment. Fix that interaction before merging, and clarify the Bun image requirements.
Security Architecture Review
Security architecture risk: 🟡 Moderate · up to 9b022
Custom images make image provenance part of the project's security responsibility. The configured build-stage image is silently ignored when custom build instructions are present, which can undermine CI hardening expectations. Existing project-code authority limits the demonstrated escalation risk, but deployment reuse and shared-builder isolation remain unverified.
Retained concerns
- Medium · security · observed: A configured buildBase, including TRIGGER_BUILD_BUILD_IMAGE, is retained in the manifest but silently ignored whenever image.instructions is nonempty. The build and indexing stages instead inherit the runtime base with an apt-installed toolchain. CI users expecting their approved build image to be used can therefore execute against a different image without an explicit conflict. This is security-control drift, not a demonstrated lower-privilege bypass: project extensions already have arbitrary build-instruction authority.
Security review details
Security Blast Radius
- inferred — A compromised selected build image can affect dependency installation and indexing; a compromised runtime base can affect task execution. Indexing receives the deployment's project API key and build environment. A common CI override can distribute this exposure across projects using it. Broader credential authority, shared-builder containment, and cross-tenant exposure were not established.
Security Findings and Attack Paths
- inferred — The supported failure path is CI selecting an approved buildBase, followed by a project or extension adding instructions, followed by generation of FROM base AS build. This can defeat the expected image-provenance policy without changing the recorded buildBase. Exploitation by a lower-privileged actor is not established because extensions already supply arbitrary build instructions.
Trust Boundaries and Controls
- observed — The new inputs select upstream image roots directly in FROM statements. Existing inputs already permit project-controlled Dockerfile instructions and post-install commands, so arbitrary project build execution is not newly introduced. The material change is which image supplier provides the filesystem, runtime binaries, and account database trusted by those executions.
Hardening Proposals
- proposed — Make buildBase plus instructions an explicit contract: reject the combination, or define stage-aware customization that honors the selected image. Record effective stage provenance rather than silently retaining an unused buildBase.
- proposed — For deployments requiring centralized hardening, consider validating pinned image references and runtime identity requirements. Confirm server deployment-reuse semantics before deciding whether resolved image identity must participate in deployment identity or require an explicit rebuild.
🚥 Pre-merge checks | ✅ 3 | ❌ 2
❌ Failed checks (2 warnings)
| Check name |
Status |
Explanation |
Resolution |
| Linked Issues check |
⚠️ Warning |
Issue #5002 requests an override for the build image, with the published BUILD_IMAGE as the fallback. The change applies buildBase only when there are no custom image instructions. With image.instruct… |
Make buildBase effective for the generated build stage when image.instructions are present, or provide a clear supported path that honors the requested build-image override in that configuration. Add a test for image.instructions combined w… |
| Docstring Coverage |
⚠️ Warning |
Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 6 files. (2 skipped: 2… |
Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (3 passed)
| Check name |
Status |
Explanation |
| Title check |
✅ Passed |
The title clearly summarizes the main change: per-project overrides for deploy base images. |
| Description check |
✅ Passed |
The description includes the linked issue, completed checklist, change summary, testing details, changelog, and screenshots section. It explains the configuration and environment-variable overrides an… |
| Out of Scope Changes check |
✅ Passed |
The changeset, configuration and manifest fields, CLI resolution, container generation, tests, and documentation all support issue #5002. No unrelated changes are shown in the available change summary… |
Full details: Linked Issues check
Explanation
Issue #5002 requests an override for the build image, with the published BUILD_IMAGE as the fallback. The change applies buildBase only when there are no custom image instructions. With image.instructions, the generated build path instead uses the runtime base and an apt-get toolchain install, so buildBase does not control that path. The PR also adds the requested config and environment precedence, preserves published-image fallbacks, records the selected overrides in the manifest, and documents the custom-image contract.
Resolution
Make buildBase effective for the generated build stage when image.instructions are present, or provide a clear supported path that honors the requested build-image override in that configuration. Add a test for image.instructions combined with buildBase.
Full details: Docstring Coverage
Explanation
Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 6 files. (2 skipped: 2 unsupported.)
- Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
![coderabbitai[bot]](/api/image?u=https%3A%2F%2Favatars.githubusercontent.com%2Fin%2F347564%3Fs%3D60%26v%3D4)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
- Configuration used: Repository UI
- Review profile: CHILL
- Plan: Advanced
- Run ID:
c7f0c9fd-96a4-42dc-bb50-720bc576ce98
📥 Commits
Reviewing files that changed from the base of the PR and between eb04c31 and 9b02208.
📒 Files selected for processing (8)
.changeset/custom-deploy-base-image.mddocs/config/config-file.mdxpackages/cli-v3/src/build/bundle.test.tspackages/cli-v3/src/build/bundle.tspackages/cli-v3/src/deploy/buildImage.test.tspackages/cli-v3/src/deploy/buildImage.tspackages/core/src/v3/config.tspackages/core/src/v3/schemas/build.ts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
|
|
|
|
- `node` (or `bun`) on `PATH` at the runtime's major version
|
|
|
- `busybox`, `ca-certificates`, `dumb-init`, `git` and `openssl`
|
|
|
- a `node` user
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Require a bun user and group for Bun images.
The Bun Containerfile uses USER bun and COPY --chown=bun:bun. A custom Bun image with only the documented node user can fail during the build. Specify node for Node images and bun for Bun images.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
|
apt-get clean && \\
|
|
|
rm -rf /var/lib/apt/lists/*`
|
|
|
: `FROM ${BUILD_IMAGE[options.runtime]} AS build
|
|
|
: `FROM ${options.image?.buildBase ?? BUILD_IMAGE[options.runtime]} AS build
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Honor buildBase when image instructions are present.
If image.instructions is nonempty, the other buildStage branch uses FROM base AS build. It ignores image.buildBase. A project that supplies a separate toolchain image therefore builds on its runtime image instead, and the toolchain install can fail. Apply the instructions to the configured build-stage image while preserving their required effects in the runtime stage.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Oct 5, 2026
This branch has not been deployed
No deployments
Reviewers
At least 1 approving review is required to merge this pull request.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|