fix(docker): serialize build stages so next build doesn't OOM on the 8 GB host #1

Merged

varutasu merged 1 commit from hotfix/docker-build-ordering into main

2026-06-05 22:04:32 -04:00

varutasu commented

2026-06-05 22:02:59 -04:00

(Migrated from github.com)

Summary

Coolify deploys started failing with exit 255 ~73s into next build. Logs show no Docker error and no Node heap error — classic kernel OOM-kill signature already called out in docker/Dockerfile's own warning comment.
Root cause: docker/Dockerfile has three build stages (web-build, collab-build, mcp-build) all FROM deps, so BuildKit ran them in parallel. The web build alone wants ~3 GB heap (capped at 5120 MB) and was racing both tsup workers + buildkit + dockerd on an 8 GB host until the kernel reaped it.
docker-compose.coolify.yml had a comment claiming depends_on on the web service would serialize the builds. It doesn't — depends_on only orders runtime startup, not docker compose build. The codebase's intent was right; the enforcement just lived in the wrong place.

Fix

Enforce ordering inside the Dockerfile DAG. Two trivial COPY --from=collab-build / COPY --from=mcp-build lines on the web-build stage force BuildKit to finish the two lightweight tsup builds first. The Next.js compile then gets the host effectively to itself. Copied files land in /tmp and are never read by the runtime web image.

Also updated the docker-compose.coolify.yml block comment so the next person reading it doesn't fall into the same depends_on misconception.

Test plan

Push triggers a Coolify deploy from main (after merge); watch logs.
Build log should show [collab-build] and [mcp-build] completing before [web web-build] RUN pnpm exec turbo build starts.
next build finishes without Retrying 1/3 spam and without exit 255.
Container starts; https://echodo.stillwell.cloud returns 200 on /.
Authentik / GitHub / Google SSO complete a sign-in round trip (regression check — last deploy fixed the DB schema, this one shouldn't undo that).

Notes

Pure infrastructure change. No app code, no schema, no env contract touched. Safe to fast-forward into main and let Coolify pick it up on the next push.

Made with Cursor

## Summary - Coolify deploys started failing with `exit 255` ~73s into `next build`. Logs show no Docker error and no Node heap error — classic kernel OOM-kill signature already called out in `docker/Dockerfile`'s own warning comment. - Root cause: `docker/Dockerfile` has three build stages (`web-build`, `collab-build`, `mcp-build`) all `FROM deps`, so BuildKit ran them in parallel. The web build alone wants ~3 GB heap (capped at 5120 MB) and was racing both tsup workers + buildkit + dockerd on an 8 GB host until the kernel reaped it. - `docker-compose.coolify.yml` had a comment claiming `depends_on` on the `web` service would serialize the builds. It doesn't — `depends_on` only orders runtime startup, not `docker compose build`. The codebase's intent was right; the enforcement just lived in the wrong place. ## Fix Enforce ordering inside the Dockerfile DAG. Two trivial `COPY --from=collab-build` / `COPY --from=mcp-build` lines on the `web-build` stage force BuildKit to finish the two lightweight tsup builds first. The Next.js compile then gets the host effectively to itself. Copied files land in `/tmp` and are never read by the runtime web image. Also updated the `docker-compose.coolify.yml` block comment so the next person reading it doesn't fall into the same `depends_on` misconception. ## Test plan - [ ] Push triggers a Coolify deploy from `main` (after merge); watch logs. - [ ] Build log should show `[collab-build]` and `[mcp-build]` completing **before** `[web web-build] RUN pnpm exec turbo build` starts. - [ ] `next build` finishes without `Retrying 1/3` spam and without `exit 255`. - [ ] Container starts; `https://echodo.stillwell.cloud` returns 200 on `/`. - [ ] Authentik / GitHub / Google SSO complete a sign-in round trip (regression check — last deploy fixed the DB schema, this one shouldn't undo that). ## Notes Pure infrastructure change. No app code, no schema, no env contract touched. Safe to fast-forward into `main` and let Coolify pick it up on the next push. Made with [Cursor](https://cursor.com)