From b58a8e702ec367b2153deb008a3bcb092e5ec1c0 Mon Sep 17 00:00:00 2001 From: "codepress-dev[bot]" <202219725+codepress-dev[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 16:08:21 +0000 Subject: [PATCH] Bootstrap CodePress Live Dev Server recipe + dev Dockerfile Adds .codepress/dev-server/recipe.json (schema_version 1) and one dev-mode Dockerfile for the single runnable frontend, the create-react-app in web/. The Dockerfile pins node:16-bookworm: this app is react-scripts 1.0.10 / webpack 2.6.1 from 2017, and Node 16 is the newest LTS predating OpenSSL 3, so the old webpack hashing path cannot fail with ERR_OSSL_EVP_UNSUPPORTED. The full -bookworm variant supplies the node-gyp toolchain for the runtime dependency install and bundles yarn 1.22, matching the repo's yarn lockfile v1, so no package manager is fetched at cold start. CRA 1.x has no WDS_SOCKET_PORT support, so HMR relies on its react-dev-utils 3.0.2 client building the sockjs URL from window.location - the websocket rides the page origin and works behind the preview proxy. DANGEROUSLY_DISABLE_HOST_CHECK is set so webpack-dev-server 2.x serves the arbitrary *.preview.codepress.dev host instead of 'Invalid Host header'. No staging_backend_url: the repo has no .env files, deploy workflows, or proxy config declaring one, so nothing was persisted rather than guessing. No preview CORS edit: the Django backend in server/ has no CORS surface at all and is same-origin by construction - web/'s postbuild copies the CRA build into server/static/build/ and the catch-all URL renders it - so it serves no cross-origin browser client. It also has a single settings.py with no staging environment, which would make a CORS change report-only regardless. Co-authored-by: dev@codepress.dev --- .codepress/dev-server/Dockerfile.web | 69 ++++++++++++++++++++++++++++ .codepress/dev-server/recipe.json | 22 +++++++++ 2 files changed, 91 insertions(+) create mode 100644 .codepress/dev-server/Dockerfile.web create mode 100644 .codepress/dev-server/recipe.json diff --git a/.codepress/dev-server/Dockerfile.web b/.codepress/dev-server/Dockerfile.web new file mode 100644 index 0000000..e6793fd --- /dev/null +++ b/.codepress/dev-server/Dockerfile.web @@ -0,0 +1,69 @@ +# Generated by CodePress bootstrap-dev-server. +# Dev-mode image for the "web" frontend (Live Dev Server). +# Edits are preserved, but running /codepress-bootstrap-dev-server again may overwrite them. + +# Node 16 is pinned deliberately. This app is create-react-app 1.0.10 (webpack +# 2.6.1, react 15) from 2017: Node 16 is the newest LTS that predates OpenSSL 3, +# so the old webpack/loader hashing path cannot fail with +# `ERR_OSSL_EVP_UNSUPPORTED: digital envelope routines::unsupported`. The FULL +# -bookworm variant (never -slim) ships the node-gyp toolchain the runtime +# dependency install needs, and it bundles yarn 1.22 — which matches this repo's +# `yarn lockfile v1` — so no package manager is downloaded at cold start. +FROM public.ecr.aws/docker/library/node:16-bookworm + +# System packages the dev runtime needs. `procps` only: this app's single native +# dependency is `fsevents` (macOS-only and optional, skipped on Linux), so no +# extra apt library is required. +RUN apt-get update \ + && apt-get install -y --no-install-recommends procps \ + && rm -rf /var/lib/apt/lists/* + +# No corepack: this base image already ships yarn 1.22 on PATH, which is the +# package manager this repo's `yarn lockfile v1` expects. Enabling corepack would +# replace that working binary with a shim that fetches yarn from the registry on +# first use, adding a network dependency to every cold start. + +WORKDIR /app + +# THIN image: no `node_modules`, no source COPY. The dev-server runtime provides +# dependencies at run time (squashfs hydration, or `yarn install +# --frozen-lockfile` in this image against the bind-mounted checkout). Only the +# toolchain lives here. + +# HMR + bind config — values come from the runtime, never hardcoded. +# +# `react-scripts start` reads HOST and PORT directly. CRA 1.x has no +# WDS_SOCKET_PORT support (that arrived in CRA 3.4); instead its HMR client +# (react-dev-utils 3.0.2 `webpackHotDevClient`) builds the sockjs URL from +# `window.location`, so the websocket rides the page origin and works behind the +# preview proxy without a client-port flag — the same origin-based behaviour as +# Next.js. CODEPRESS_HMR_CLIENT_PORT / CODEPRESS_HMR_PROTOCOL stay declared so +# the runtime contract is uniform across frontends. +ENV HOSTNAME=0.0.0.0 \ + HOST=0.0.0.0 \ + CODEPRESS_BIND_HOST=0.0.0.0 \ + PORT=3000 \ + CODEPRESS_HMR_CLIENT_PORT=443 \ + CODEPRESS_HMR_PROTOCOL=wss \ + BROWSER=none \ + CI=true \ + DANGEROUSLY_DISABLE_HOST_CHECK=true + +# BROWSER=none stops CRA trying to launch a browser in the container. +# DANGEROUSLY_DISABLE_HOST_CHECK is the CRA equivalent of Vite's +# `server.allowedHosts`: previews are served from an arbitrary +# *.preview.codepress.dev host, and webpack-dev-server 2.x would otherwise answer +# "Invalid Host header" instead of the app. It affects this dev image only. + +WORKDIR /app/web +EXPOSE 3000 + +# Put the workspace bins on PATH so the dev command resolves node_modules/.bin +# even when a binary is invoked directly. These dirs are populated at run time on +# the bind-mounted checkout (hydration / runtime install). Prepend, never replace +# ${PATH}. +ENV PATH="/app/web/node_modules/.bin:/app/node_modules/.bin:${PATH}" + +# Dev command (HMR on). `react-scripts start` honors HOST and PORT from the env +# above. Routed through yarn rather than invoking the bin bare. +CMD ["yarn", "start"] diff --git a/.codepress/dev-server/recipe.json b/.codepress/dev-server/recipe.json new file mode 100644 index 0000000..08f4379 --- /dev/null +++ b/.codepress/dev-server/recipe.json @@ -0,0 +1,22 @@ +{ + "schema_version": 1, + "bootstrapped_at": "2026-07-27T16:07:21Z", + "discovery_branch": "master", + "frontends": [ + { + "label": "web", + "working_dir": "web", + "dockerfile_path": ".codepress/dev-server/Dockerfile.web", + "dev_command": "yarn start", + "prebuild_command": "", + "prebuild_inputs": [], + "framework": "cra", + "package_manager": "yarn", + "install_command": "yarn install --frozen-lockfile", + "dependency_manifests": ["web/yarn.lock"], + "dev_port": 3000, + "system_packages": ["procps"], + "size": "medium" + } + ] +}