fix(docker): worker HEALTHCHECK, align docling lab digest, lab pip cache by BigSimmo · Pull Request #3643 · BigSimmo/PsychSift

BigSimmo · 2026-10-18T09:30:23Z

User description

Summary

Small Docker review items (a companion to #3642, the Compose safety PR).

Dockerfile.worker: add a HEALTHCHECK on /health. It resolves the port the same way worker/health.ts does (WORKER_HEALTH_PORT, then PORT). If neither is set, the health server is off, so the probe exits 1 with an explicit message instead of reporting healthy. Railway compatibility: Railway ignores Docker HEALTHCHECK (docs) and keeps gating deploys on railway.worker.json healthcheckPath: /health on PORT. The app Dockerfile already ships a HEALTHCHECK the same way. The instruction sits on one line because tests/tsx-server-only-runner.test.ts reads the first CMD-prefixed line as the entrypoint.
eval/docling/Dockerfile: pin the same node:24-bookworm-slim@sha256:d6aa754f… digest as Dockerfile and Dockerfile.worker. The old pin was 235600a8…. Both are valid multi-arch OCI indexes.
BuildKit cache mounts: added pip cache mounts only to the local docling lab image (eval/docling/Dockerfile), where --require-hashes still verifies every artifact. I did not add them to Dockerfile or Dockerfile.worker: tests/container-ci-contract.test.ts ("keeps Railway Dockerfiles portable across service IDs") forbids --mount=type=cache there, and I left that check as it is.

Areas touched: Delivery and assurance, Source intake and indexing

Verification

vitest run on container-ci-contract, docling-model-artifacts, worker-shadow-extraction, tsx-server-only-runner, sentry-release, railway-config, database-skills, ci-audit-contracts and worker-bundle → Test Files 9 passed (9) / Tests 202 passed (202)
I ran the healthcheck expression against a stub server. WORKER_HEALTH_PORT → exit 0; PORT → exit 0; neither set → exit 1 with "worker health server disabled"; server down → exit 1
ci-change-scope → container_changed=true, so the required Docker image build and smoke run in CI. I couldn't build locally because the box has no Docker daemon.

Risk and rollout

Risk: Low. The image gains a HEALTHCHECK, and Railway gating doesn't change. The lab image changes only its base digest and build cache.
Rollback: Revert this PR.
Provider or production effects: None.

Notes

I didn't bump Trivy here, as requested. A future PR can update the Trivy version or action used by scripts/trivy-image-scan.mjs.

Summary by cubic

Adds a container-runtime health probe to the worker image and aligns the docling lab image with the main Dockerfiles.

Worker HEALTHCHECK probes /health on WORKER_HEALTH_PORT, falling back to PORT like worker/health.ts; if neither is set it exits 1 with an explicit message instead of claiming healthy.
docker-compose.yml sets WORKER_HEALTH_PORT: 8000 for the health probe; no host port is exposed.
Railway ignores HEALTHCHECK and keeps gating on railway.worker.json, so deploy behavior is unchanged.
The lab image's node:24-bookworm-slim pin now matches the digest used by Dockerfile and Dockerfile.worker.
BuildKit pip cache mounts speed up lab rebuilds; --require-hashes still verifies every artifact, and run-lab.sh now requires a BuildKit builder. The Railway images intentionally keep cache mounts out per container-ci-contract.test.ts.
The healthcheck stays on one line because tsx-server-only-runner.test.ts reads the first CMD-prefixed line as the entrypoint.

^{Written for commit c561b7d. Summary will update on new commits.}

CodeAnt-AI Description

Add worker container health checks and speed up Docling lab rebuilds

What Changed

Docker and Compose can now detect when the worker’s /health endpoint is unavailable; the probe reports unhealthy if no health port is configured.
Docling lab rebuilds reuse cached Python packages while still verifying dependencies.
The Docling lab image now uses the same pinned base image as the application and worker images.

Impact

✅ Clearer worker container health status
✅ Faster Docling lab rebuilds
✅ Consistent base image across containers

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by Gitar

Compose configuration:
- Set WORKER_HEALTH_PORT: 8000 on the worker service in docker-compose.yml for the internal health listener

_{This will update automatically on new commits.}

Summary by CodeRabbit

Reliability
- Added Docker health monitoring for the worker, using its configured health-check port and reporting unhealthy when the endpoint is unavailable or returns an error.
Developer Tools
- The document-processing benchmark now checks for a working Docker Buildx builder before building and enables BuildKit for the build.
- Improved dependency installation caching in the benchmark image build to help speed up repeated builds.

- Dockerfile.worker: add a HEALTHCHECK on /health using WORKER_HEALTH_PORT, falling back to PORT (the same resolution as worker/health.ts). Railway ignores HEALTHCHECK and keeps using railway.worker.json's healthcheckPath. - eval/docling/Dockerfile: pin the same node:24-bookworm-slim digest as Dockerfile and Dockerfile.worker. - eval/docling/Dockerfile: BuildKit pip cache mounts for the two hashed venv installs. The Railway Dockerfiles stay free of cache mounts, as tests/container-ci-contract.test.ts requires.

greptile-apps

BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

codeant-ai · 2026-10-18T09:30:32Z

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	`62dea8b`	Oct 18, 2026 · 09:30	09:34

codeant-ai · 2026-10-18T09:30:33Z

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

coderabbitai · 2026-10-18T09:30:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: BigSimmo/PsychSift/.coderabbit.yaml
Review profile: CHILL
Plan: Team
Run ID: 4e9af289-f7f0-419d-8f5c-8f7b8dd3b854

📥 Commits

Reviewing files that changed from the base of the PR and between 9ba5b29 and c561b7d.

📒 Files selected for processing: 5

Dockerfile.worker
docker-compose.yml
eval/docling/Dockerfile
eval/docling/README.md
eval/docling/run-lab.sh

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The worker image adds a Docker health check configured through Docker Compose. The Docling image adds BuildKit pip cache mounts, and its local runner checks for Buildx and enables BuildKit.

Changes: Worker health check

Layer / File(s)	Summary
Configure the worker health check `Dockerfile.worker`, `docker-compose.yml`	The worker image probes `/health` using `WORKER_HEALTH_PORT` or `PORT`. Docker Compose sets `WORKER_HEALTH_PORT` to `8000`.

Docling image build

Layer / File(s)	Summary
Update the Docling image build `eval/docling/Dockerfile`	The Dockerfile enables BuildKit syntax, updates the pinned Node image digest, and uses pip cache mounts for both virtual environment installs.
Check Buildx before local builds `eval/docling/run-lab.sh`, `eval/docling/README.md`	The runner checks that `docker buildx inspect` succeeds and enables BuildKit for the build. The README documents the Buildx requirement.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: claude

Merge Risk: ⚪ Minimal · up to c561b

The worker health check matches its server configuration, and the documented lab build enables BuildKit. No material merge risk remains in the reviewed changes.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarizes the main Docker health-check, Docling digest, and pip-cache changes. It is concise and specific.
Description check		The description includes the required Summary, Verification, Risk and rollout, and Notes sections. It records focused test results, health-check validation, the unavailable local Docker daemon, risk, …
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required Summary, Verification, Risk and rollout, and Notes sections. It records focused test results, health-check validation, the unavailable local Docker daemon, risk, rollback, and production effects.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-18T09:30:35Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-18T09:32:40.920558Z	`62dea8b`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

claude · 2026-10-18T09:30:43Z

Claude encountered an error after 2s —— View job

I'll analyze this and get back to you.

supabase · 2026-10-18T09:30:48Z

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

codeant-ai · 2026-10-18T09:31:01Z

🏁 CodeAnt Quality Gate Results

Commit: c561b7d7
Scan Time: 2026-10-18 09:53:54 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating B: 1 issues (1 medium)

View Full Results

qodo-code-review · 2026-10-18T09:31:04Z

PR Summary by Qodo

Add worker Docker healthcheck and speed up Docling lab builds

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Add a worker container healthcheck that reports unhealthy when its health server is disabled or
 unreachable.
• Align the Docling lab's Node base digest with the production images.
• Cache hash-verified pip downloads across local lab builds without changing Railway images.

Diagram

graph TD
  A["Worker environment"] --> B{"Port configured?"} -->|yes| C["HTTP probe"] --> D["Worker /health"] --> E["Probe result"]
  B -->|no, unhealthy| E
  F["Pinned Node base"] --> H["Hashed venv installs"]
  G["Pip cache"] --> H

High-Level Assessment

Keep the probe in the worker Dockerfile, matching the app image's existing approach and the worker server's port precedence. Restricting BuildKit caches to the local lab preserves Railway Dockerfile portability; an external probe script or cache mounts in production images would add complexity without a clear benefit.

Files changed (2) +23 / -5

Bug fix (1) +9 / -0

Dockerfile.workerProbe the worker's existing health endpoint +9/-0

Probe the worker's existing health endpoint

• Adds a Docker HEALTHCHECK that tries WORKER_HEALTH_PORT before PORT and fails explicitly if neither is set. It reports unhealthy for failed HTTP requests without changing Railway's separate deployment health gate.

Dockerfile.worker

Other (1) +14 / -5

DockerfileAlign the lab base image and cache hashed pip installs +14/-5

Align the lab base image and cache hashed pip installs

• Pins the lab image to the Node digest used by the production Dockerfiles. Adds BuildKit pip cache mounts to both lab virtual-environment installs while retaining required hash verification.

eval/docling/Dockerfile

gitar-bot

Gitar has auto-approved this PR (configure)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62dea8b3ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

qodo-code-review · 2026-10-18T09:32:50Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

No findings for this group

Resolved findings

1. ~~Compose workers always appear unhealthy~~ ✓ Resolved

Description

The new HEALTHCHECK exits with status 1 when neither WORKER_HEALTH_PORT nor PORT is set. The
Compose worker sets neither variable, so its health server remains disabled and a normally running
worker is reported unhealthy after the start period.

Code

Dockerfile.worker[169]

+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 CMD node -e "const p=process.env.WORKER_HEALTH_PORT||process.env.PORT;if(!p){console.error('worker health server disabled: set WORKER_HEALTH_PORT or PORT');process.exit(1)}fetch('http://127.0.0.1:'+p+'/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

Relevance

●●● Strong
Compose omits both required ports, so the inherited healthcheck deterministically marks healthy
workers unhealthy.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Compose inherits the image healthcheck but does not configure either port it requires. With no port,
the health server returns without listening, while the probe explicitly fails.
Dockerfile.worker[161-169]
docker-compose.yml[44-65]
worker/health.ts[209-223]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The image healthcheck requires a configured health port, but the Compose worker configures none and therefore always appears unhealthy.

## Fix Focus Areas
- Dockerfile.worker[169-169]
- docker-compose.yml[44-65]

## Recommended Fix
Set `WORKER_HEALTH_PORT` to a suitable internal port in the Compose worker environment so the existing health server starts and the probe can reach it. The port need not be published to the host.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Slow valid health replies are discarded~~ ✓ Resolved

Description

The new probe has a five-second timeout, but performHealthCheck() runs a Supabase check with its
own five-second allowance before running an independently timed Python check. When both succeed but
their combined duration exceeds five seconds, Docker times out the probe before the endpoint can
return its successful response; the uncached Python check can cause this again after its cache
expires.

Code

Dockerfile.worker[169]

+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 CMD node -e "const p=process.env.WORKER_HEALTH_PORT||process.env.PORT;if(!p){console.error('worker health server disabled: set WORKER_HEALTH_PORT or PORT');process.exit(1)}fetch('http://127.0.0.1:'+p+'/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

Relevance

●●● Strong
The probe deadline is shorter than sequential successful checks; recent timeout-budget findings were
accepted.
PR-#3154
PR-#3604

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The Docker deadline covers the entire command, whereas the endpoint awaits two checks in sequence.
Supabase receives a five-second deadline and an uncached Python invocation separately allows up to
five seconds, so a successful response need not arrive within the Docker timeout.

Dockerfile.worker[169-169]
worker/health.ts[66-94]
worker/health.ts[128-158]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Docker's five-second probe timeout is shorter than the combined duration permitted by the endpoint's sequential checks, so it can discard successful responses.

## Fix Focus Areas
- Dockerfile.worker[169-169]
- worker/health.ts[66-94]
- worker/health.ts[128-158]

## Recommended Fix
Set the Docker healthcheck timeout above the endpoint's combined Supabase and uncached Python check budget, including a small margin for request and process startup.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~Some Docker installs cannot build the lab~~ ✓ Resolved

Description

The lab Dockerfile now requires BuildKit-only RUN --mount instructions, while run-lab.sh checks
only for a Docker executable before invoking docker build. An operator using the documented Docker
prerequisite with BuildKit disabled, or a CLI that falls back to the legacy builder, cannot build
the benchmark image.

Code

eval/docling/Dockerfile[37]
+RUN --mount=type=cache,target=/root/.cache/pip \

Relevance

●●● Strong
The Dockerfile requires BuildKit syntax, but the documented runner neither enables nor validates
BuildKit before building.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Both changed installation steps use RUN --mount, but the manual runner neither selects nor
verifies a BuildKit builder. Docker documents both that RUN --mount is a Dockerfile frontend
feature and that docker build can use the legacy builder when BuildKit is disabled or Buildx is
unavailable.
eval/docling/Dockerfile[37-48]
eval/docling/run-lab.sh[21-29]
eval/docling/README.md[113-123]
🌐 Documents RUN --mount as a Dockerfile frontend feature.
🌐 Documents legacy-builder fallback and explicit BuildKit opt-out for docker build.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new cache mounts require BuildKit, but the lab runner accepts Docker installations that use the legacy builder.

## Fix Focus Areas
- eval/docling/Dockerfile[37-37]
- eval/docling/run-lab.sh[21-29]
- eval/docling/README.md[113-123]

## Recommended Fix
Make BuildKit an explicit, checked prerequisite for the lab build and document it alongside Docker. Have the runner fail with a clear prerequisite error when BuildKit is unavailable rather than proceeding to the Dockerfile build.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

❌ Tickets: failed to load — Ticket collection could not establish complete evidence

✅ Compliance rules (platform): 9 rules

✅ Cross-repo context — repo relationships

Review mode: Auto: ⚖️ Balanced: Docker runtime and build behavior changes carry real operational risk.

Tip of the day

💡 Did you know, you can move or hide resolved findings to focus on what still needs action

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit c561b7d

Results up to commit 62dea8b ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

No findings for this group

Resolved findings

1. ~~Compose workers always appear unhealthy~~ ✓ Resolved

Description

The new HEALTHCHECK exits with status 1 when neither WORKER_HEALTH_PORT nor PORT is set. The
Compose worker sets neither variable, so its health server remains disabled and a normally running
worker is reported unhealthy after the start period.

Code

Dockerfile.worker[169]

+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 CMD node -e "const p=process.env.WORKER_HEALTH_PORT||process.env.PORT;if(!p){console.error('worker health server disabled: set WORKER_HEALTH_PORT or PORT');process.exit(1)}fetch('http://127.0.0.1:'+p+'/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

Relevance

●●● Strong
Compose omits both required ports, so the inherited healthcheck deterministically marks healthy
workers unhealthy.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Compose inherits the image healthcheck but does not configure either port it requires. With no port,
the health server returns without listening, while the probe explicitly fails.
Dockerfile.worker[161-169]
docker-compose.yml[44-65]
worker/health.ts[209-223]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The image healthcheck requires a configured health port, but the Compose worker configures none and therefore always appears unhealthy.

## Fix Focus Areas
- Dockerfile.worker[169-169]
- docker-compose.yml[44-65]

## Recommended Fix
Set `WORKER_HEALTH_PORT` to a suitable internal port in the Compose worker environment so the existing health server starts and the probe can reach it. The port need not be published to the host.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Slow valid health replies are discarded~~ ✓ Resolved

Description

The new probe has a five-second timeout, but performHealthCheck() runs a Supabase check with its
own five-second allowance before running an independently timed Python check. When both succeed but
their combined duration exceeds five seconds, Docker times out the probe before the endpoint can
return its successful response; the uncached Python check can cause this again after its cache
expires.

Code

Dockerfile.worker[169]

+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 CMD node -e "const p=process.env.WORKER_HEALTH_PORT||process.env.PORT;if(!p){console.error('worker health server disabled: set WORKER_HEALTH_PORT or PORT');process.exit(1)}fetch('http://127.0.0.1:'+p+'/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

Relevance

●●● Strong
The probe deadline is shorter than sequential successful checks; recent timeout-budget findings were
accepted.
PR-#3154
PR-#3604

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The Docker deadline covers the entire command, whereas the endpoint awaits two checks in sequence.
Supabase receives a five-second deadline and an uncached Python invocation separately allows up to
five seconds, so a successful response need not arrive within the Docker timeout.

Dockerfile.worker[169-169]
worker/health.ts[66-94]
worker/health.ts[128-158]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Docker's five-second probe timeout is shorter than the combined duration permitted by the endpoint's sequential checks, so it can discard successful responses.

## Fix Focus Areas
- Dockerfile.worker[169-169]
- worker/health.ts[66-94]
- worker/health.ts[128-158]

## Recommended Fix
Set the Docker healthcheck timeout above the endpoint's combined Supabase and uncached Python check budget, including a small margin for request and process startup.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. ~~Some Docker installs cannot build the lab~~ ✓ Resolved

Description

The lab Dockerfile now requires BuildKit-only RUN --mount instructions, while run-lab.sh checks
only for a Docker executable before invoking docker build. An operator using the documented Docker
prerequisite with BuildKit disabled, or a CLI that falls back to the legacy builder, cannot build
the benchmark image.

Code

eval/docling/Dockerfile[37]
+RUN --mount=type=cache,target=/root/.cache/pip \

Relevance

●●● Strong
The Dockerfile requires BuildKit syntax, but the documented runner neither enables nor validates
BuildKit before building.
ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Both changed installation steps use RUN --mount, but the manual runner neither selects nor
verifies a BuildKit builder. Docker documents both that RUN --mount is a Dockerfile frontend
feature and that docker build can use the legacy builder when BuildKit is disabled or Buildx is
unavailable.
eval/docling/Dockerfile[37-48]
eval/docling/run-lab.sh[21-29]
eval/docling/README.md[113-123]
🌐 Documents RUN --mount as a Dockerfile frontend feature.
🌐 Documents legacy-builder fallback and explicit BuildKit opt-out for docker build.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new cache mounts require BuildKit, but the lab runner accepts Docker installations that use the legacy builder.

## Fix Focus Areas
- eval/docling/Dockerfile[37-37]
- eval/docling/run-lab.sh[21-29]
- eval/docling/README.md[113-123]

## Recommended Fix
Make BuildKit an explicit, checked prerequisite for the lab build and document it alongside Docker. Have the runner fail with a clear prerequisite error when BuildKit is unavailable rather than proceeding to the Dockerfile build.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- Configure the Compose worker health port - Allow the full worker health-check duration

qodo-code-review · 2026-10-18T09:33:38Z

Qodo Fixer

✅ Committed (3) · ☑ Fixed (3)

Commits pushed directly to this PR — no separate fix PR opened.

Process — 3 fixed

☑ Fixed: Compose workers always appear unhealthy
☑ Fixed: Slow valid health replies are discarded
☑ Fixed: Some Docker installs cannot build the lab

gitar-bot · 2026-10-18T09:34:05Z

Code Review ✅ Approved

🟡 Medium risk · Adding a worker /health probe and Compose health port could mark the container unhealthy when the endpoint is unreachable, affecting orchestration.

Adds a HEALTHCHECK to the worker Dockerfile that probes /health on WORKER_HEALTH_PORT or PORT, pins the docling lab base image to the same digest as the other Dockerfiles, and adds pip cache mounts to the lab image. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Approved

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

`Auto-apply`	`Compact`
`gitar auto-apply:on`	`gitar display:verbose`

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

gitar-bot

Gitar has auto-approved this PR (configure)

codeant-ai · 2026-10-18T09:34:17Z

CodeAnt Nitpicks

1 code suggestion

1. With the Compose worker's default environment, neither port is set, so this probe always fails and Docker reports a working worker as unhealthy.

Api mismatch · Dockerfile.worker:169

codeant-ai · 2026-10-18T09:34:42Z

CodeAnt PR Risk: Low Risk

The PR appears safe to merge; the changes are limited to worker health checking and Docling lab build setup.
Compose sets the worker health port, and the lab runner checks for BuildKit before building with cache mounts.

Assessed commit: c561b7d766d6

qodo-code-review · 2026-10-18T09:35:21Z

Code review by qodo was updated up to the latest commit c561b7d

BigSimmo enabled auto-merge (squash) October 18, 2026 09:30

greptile-apps Bot reviewed Oct 18, 2026

View reviewed changes

codeant-ai Bot added the size:S This PR changes 10-29 lines, ignoring generated files label Oct 18, 2026

qodo-code-review Bot added the 🕐 10-20 Minutes label Oct 18, 2026

gitar-bot Bot previously approved these changes Oct 18, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread Dockerfile.worker Resolved

qodo-code-review Bot added the 🟠 Medium blast radius label Oct 18, 2026

qodo-code-review Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread Dockerfile.worker Resolved

Comment thread eval/docling/Dockerfile Resolved

Comment thread Dockerfile.worker Resolved

fix: 2 findings — Configure the Compose worker health port; Allow the fu

671bed9

- Configure the Compose worker health port - Allow the full worker health-check duration

qodo-code-review Bot dismissed gitar-bot[bot]’s stale review via 671bed9 October 18, 2026 09:33

fix: Require BuildKit for lab builds

c561b7d

gitar-bot Bot approved these changes Oct 18, 2026

View reviewed changes

BigSimmo merged commit 807ce0c into main Oct 18, 2026
46 of 51 checks passed

BigSimmo deleted the fix/docker-worker-healthcheck-20261018 branch October 18, 2026 09:53

Conversation

BigSimmo commented Oct 18, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Summary

Verification

Risk and rollout

Notes

Summary by cubic

CodeAnt-AI Description

What Changed

Impact

Checking Your Pull Request

Talking to CodeAnt AI

Example

Preserve Org Learnings with CodeAnt

Example

Retrigger review

Check Your Repository Health

Summary by Gitar

Summary by CodeRabbit

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codeant-ai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CodeAnt AI — Review Status

Uh oh!

codeant-ai Bot commented Oct 18, 2026

Thanks for using CodeAnt! 🎉

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

claude Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supabase Bot commented Oct 18, 2026

Uh oh!

codeant-ai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏁 CodeAnt Quality Gate Results

✅ Overall Status: PASSED

Quality Gate Details

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

PR Summary by Qodo

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Resolved findings

Resolved findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

Qodo Fixer

Uh oh!

gitar-bot Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codeant-ai Bot commented Oct 18, 2026

BigSimmo commented Oct 18, 2026 •

edited by cubic-dev-ai Bot

Loading

codeant-ai Bot commented Oct 18, 2026 •

edited

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 18, 2026 •

edited

Loading

claude Bot commented Oct 18, 2026 •

edited

Loading

codeant-ai Bot commented Oct 18, 2026 •

edited

Loading

qodo-code-review Bot commented Oct 18, 2026 •

edited

Loading

gitar-bot Bot commented Oct 18, 2026 •

edited

Loading