diff options
| author | Claude <noreply@anthropic.com> | 2026-08-25 21:22:55 -0500 |
|---|---|---|
| committer | Claude <noreply@anthropic.com> | 2026-08-25 21:22:55 -0500 |
| commit | 9d934f49d032694e98f799f042e5eca30de6119c (patch) | |
| tree | f0f542f0632a08e50ddd28337fe4edced601b79e | |
| parent | acde3827f60bc90738429fa490a36a1856a93283 (diff) | |
Run app builds inside the jail via jexec, not the host
Builds previously ran as a bare host process, sharing one host-wide
toolchain across every app - a Go/gcc upgrade on the host silently
changed what the next deploy of any app picked up, and cgo builds
needed the exact right headers/compiler on the host regardless of
what each app actually targets. Routing the build through jexec, the
same mechanism release.Run already uses for the release phase, gives
each app's own persistent jail an independently-managed toolchain
instead.
| -rw-r--r-- | internal/deploy/deploy.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/internal/deploy/deploy.go b/internal/deploy/deploy.go index 751c976..30846ac 100644 --- a/internal/deploy/deploy.go +++ b/internal/deploy/deploy.go @@ -63,7 +63,7 @@ func Run(ctx context.Context, out io.Writer, cfg layout.Config, app, sha string) }() fmt.Fprintln(out, "==> building") - if err := sh.Run(ctx, out, releaseDir, "make", "-B"); err != nil { + if err := sh.Run(ctx, out, "", "jexec", app, "make", "-B", "-C", cfg.ReleaseDirInJail(sha)); err != nil { return fmt.Errorf("build: %w", err) } if _, err := os.Stat(filepath.Join(releaseDir, "app")); err != nil { |