Feat: unified deploys for self-hosted and cloud users incl. multi-platform support (#2138)

* remove registry proxy

* remove --self-hosted flag

* automatically set network build flag

* update syncEnvVars debug log

* improve switch command

* always display deploy errors if they exist

* fix stuck deploy command after finalize error

* webapp-driven deploys, multi-platform support, lots of fixes

* add worker deployment migration

* rename image platform env var

* only try to sync parent env vars for preview deployments

* add KEEP_TMP_DIRS

* supervisor: docker api version lock, auth, multi-platform

* set image ref on create, validate digest

* use metadata for digest, fix local multi-platform builds

* print git meta branch before commit

* improve push and load flag handling

* make runs after local builds compatible with load and push

* small improvement for platform overrides

* add image platform to dequeued message

* remove deprecated init request body fields

* fix fail deployment id param

* remove build debug logs

* pass report merge with no tests

* structured run debug logs

* add required env var for tests

* should not be an error log

* add changeset

Author: nicktrn

.changeset/ninety-games-grow.md

@@ -0,0 +1,11 @@
+---
+"trigger.dev": patch
+"@trigger.dev/core": patch
+---
+
+- Resolve issue where CLI could get stuck during deploy finalization
+- Unify local and remote build logic, with multi-platform build support
+- Improve switch command; now accepts profile name as an argument
+- Registry configuration is now fully managed by the webapp
+- The deploy `--self-hosted` flag is no longer required
+- Enhance deployment error reporting and image digest retrieval

.env.example

@@ -80,14 +80,9 @@ CLOUD_SLACK_CLIENT_SECRET=
 PROVIDER_SECRET=provider-secret # generate the actual secret with `openssl rand -hex 32`
 COORDINATOR_SECRET=coordinator-secret # generate the actual secret with `openssl rand -hex 32`
 
-# Uncomment the following line to enable the registry proxy
-# ENABLE_REGISTRY_PROXY=true
+# DEPOT_ORG_ID=<Depot org id>
 # DEPOT_TOKEN=<Depot org token>
-# DEPOT_PROJECT_ID=<Depot project id>
-# DEPLOY_REGISTRY_HOST=${APP_ORIGIN} # This is the host that the deploy CLI will use to push images to the registry
-# CONTAINER_REGISTRY_ORIGIN=<Container registry origin e.g. https://registry.digitalocean.com>
-# CONTAINER_REGISTRY_USERNAME=<Container registry username e.g. Digital ocean email address>
-# CONTAINER_REGISTRY_PASSWORD=<Container registry password e.g. Digital ocean PAT>
+DEPLOY_REGISTRY_HOST=${APP_ORIGIN} # This is the host that the deploy CLI will use to push images to the registry
 # DEV_OTEL_EXPORTER_OTLP_ENDPOINT="http://0.0.0.0:4318"
 # These are needed for the object store (for handling large payloads/outputs)
 # OBJECT_STORE_BASE_URL="https://{bucket}.{accountId}.r2.cloudflarestorage.com"

.github/workflows/unit-tests-internal.yml

@@ -127,4 +127,4 @@ jobs:
           merge-multiple: true
 
       - name: Merge reports
-        run: pnpm dlx vitest@3.1.4 run --merge-reports
+        run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests

.github/workflows/unit-tests-packages.yml

@@ -127,4 +127,4 @@ jobs:
           merge-multiple: true
 
       - name: Merge reports
-        run: pnpm dlx vitest@3.1.4 run --merge-reports
+        run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests

.github/workflows/unit-tests-webapp.yml

@@ -86,6 +86,7 @@ jobs:
           SESSION_SECRET: "secret"
           MAGIC_LINK_SECRET: "secret"
           ENCRYPTION_KEY: "secret"
+          DEPLOY_REGISTRY_HOST: "docker.io"
 
       - name: Gather all reports
         if: ${{ !cancelled() }}
@@ -133,4 +134,4 @@ jobs:
           merge-multiple: true
 
       - name: Merge reports
-        run: pnpm dlx vitest@3.1.4 run --merge-reports
+        run: pnpm dlx vitest@3.1.4 run --merge-reports --pass-with-no-tests

apps/supervisor/src/env.ts

@@ -28,6 +28,7 @@ const Env = z.object({
   RUNNER_HEARTBEAT_INTERVAL_SECONDS: z.coerce.number().optional(),
   RUNNER_SNAPSHOT_POLL_INTERVAL_SECONDS: z.coerce.number().optional(),
   RUNNER_ADDITIONAL_ENV_VARS: AdditionalEnvVars, // optional (csv)
+  RUNNER_PRETTY_LOGS: BoolEnv.default(false),
   RUNNER_DOCKER_AUTOREMOVE: BoolEnv.default(true),
   /**
    * Network mode to use for all runners. Supported standard values are: `bridge`, `host`, `none`, and `container:<name|id>`.
@@ -41,6 +42,14 @@ const Env = z.object({
    */
   RUNNER_DOCKER_NETWORKS: z.string().default("host"),
 
+  // Docker settings
+  DOCKER_API_VERSION: z.string().default("v1.41"),
+  DOCKER_PLATFORM: z.string().optional(), // e.g. linux/amd64, linux/arm64
+  DOCKER_STRIP_IMAGE_DIGEST: BoolEnv.default(true),
+  DOCKER_REGISTRY_USERNAME: z.string().optional(),
+  DOCKER_REGISTRY_PASSWORD: z.string().optional(),
+  DOCKER_REGISTRY_URL: z.string().optional(), // e.g. https://index.docker.io/v1
+
   // Dequeue settings (provider mode)
   TRIGGER_DEQUEUE_ENABLED: BoolEnv.default("true"),
   TRIGGER_DEQUEUE_INTERVAL_MS: z.coerce.number().int().default(250),

apps/supervisor/src/util.ts

@@ -1,8 +1,7 @@
-export function getDockerHostDomain() {
-  const isMacOs = process.platform === "darwin";
-  const isWindows = process.platform === "win32";
+import { isMacOS, isWindows } from "std-env";
 
-  return isMacOs || isWindows ? "host.docker.internal" : "localhost";
+export function getDockerHostDomain() {
+  return isMacOS || isWindows ? "host.docker.internal" : "localhost";
 }
 
 export function getRunnerId(runId: string, attemptNumber?: number) {

apps/supervisor/src/workloadManager/docker.ts

@@ -14,9 +14,13 @@ export class DockerWorkloadManager implements WorkloadManager {
   private readonly docker: Docker;
 
   private readonly runnerNetworks: string[];
+  private readonly auth?: Docker.AuthConfig;
+  private readonly platformOverride?: string;
 
   constructor(private opts: WorkloadManagerOptions) {
-    this.docker = new Docker();
+    this.docker = new Docker({
+      version: env.DOCKER_API_VERSION,
+    });
 
     if (opts.workloadApiDomain) {
       this.logger.warn("⚠️ Custom workload API domain", {
@@ -25,6 +29,29 @@ export class DockerWorkloadManager implements WorkloadManager {
     }
 
     this.runnerNetworks = env.RUNNER_DOCKER_NETWORKS.split(",");
+
+    this.platformOverride = env.DOCKER_PLATFORM;
+    if (this.platformOverride) {
+      this.logger.info("🖥️  Platform override", {
+        targetPlatform: this.platformOverride,
+        hostPlatform: process.arch,
+      });
+    }
+
+    if (env.DOCKER_REGISTRY_USERNAME && env.DOCKER_REGISTRY_PASSWORD && env.DOCKER_REGISTRY_URL) {
+      this.logger.info("🐋 Using Docker registry credentials", {
+        username: env.DOCKER_REGISTRY_USERNAME,
+        url: env.DOCKER_REGISTRY_URL,
+      });
+
+      this.auth = {
+        username: env.DOCKER_REGISTRY_USERNAME,
+        password: env.DOCKER_REGISTRY_PASSWORD,
+        serveraddress: env.DOCKER_REGISTRY_URL,
+      };
+    } else {
+      this.logger.warn("🐋 No Docker registry credentials provided, skipping auth");
+    }
   }
 
   async create(opts: WorkloadManagerCreateOptions) {
@@ -45,6 +72,7 @@ export class DockerWorkloadManager implements WorkloadManager {
       `TRIGGER_WORKER_INSTANCE_NAME=${env.TRIGGER_WORKER_INSTANCE_NAME}`,
       `OTEL_EXPORTER_OTLP_ENDPOINT=${env.OTEL_EXPORTER_OTLP_ENDPOINT}`,
       `TRIGGER_RUNNER_ID=${runnerId}`,
+      `PRETTY_LOGS=${env.RUNNER_PRETTY_LOGS}`,
     ];
 
     if (this.opts.warmStartUrl) {
@@ -90,41 +118,103 @@ export class DockerWorkloadManager implements WorkloadManager {
       hostConfig.Memory = opts.machine.memory * 1024 * 1024 * 1024;
     }
 
+    let imageRef = opts.image;
+
+    if (env.DOCKER_STRIP_IMAGE_DIGEST) {
+      imageRef = opts.image.split("@")[0]!;
+    }
+
     const containerCreateOpts: Docker.ContainerCreateOptions = {
-      Env: envVars,
       name: runnerId,
       Hostname: runnerId,
       HostConfig: hostConfig,
-      Image: opts.image,
+      Image: imageRef,
       AttachStdout: false,
       AttachStderr: false,
       AttachStdin: false,
     };
 
-    try {
-      // Create container
-      const container = await this.docker.createContainer(containerCreateOpts);
+    if (this.platformOverride) {
+      containerCreateOpts.platform = this.platformOverride;
+    }
+
+    const logger = this.logger.child({ opts, containerCreateOpts });
+
+    const [inspectError, inspectResult] = await tryCatch(this.docker.getImage(imageRef).inspect());
+
+    let shouldPull = !!inspectError;
+    if (this.platformOverride) {
+      const imageArchitecture = inspectResult?.Architecture;
+
+      // When the image architecture doesn't match the platform, we need to pull the image
+      if (imageArchitecture && !this.platformOverride.includes(imageArchitecture)) {
+        shouldPull = true;
+      }
+    }
+
+    // If the image is not present, try to pull it
+    if (shouldPull) {
+      logger.info("Pulling image", {
+        error: inspectError,
+        image: opts.image,
+        targetPlatform: this.platformOverride,
+        imageArchitecture: inspectResult?.Architecture,
+      });
 
-      // If there are multiple networks to attach to we need to attach the remaining ones after creation
-      if (remainingNetworks.length > 0) {
-        await this.attachContainerToNetworks({
-          containerId: container.id,
-          networkNames: remainingNetworks,
-        });
+      // Ensure the image is present
+      const [createImageError, imageResponseReader] = await tryCatch(
+        this.docker.createImage(this.auth, {
+          fromImage: imageRef,
+          ...(this.platformOverride ? { platform: this.platformOverride } : {}),
+        })
+      );
+      if (createImageError) {
+        logger.error("Failed to pull image", { error: createImageError });
+        return;
       }
 
-      // Start container
-      const startResult = await container.start();
+      const [imageReadError, imageResponse] = await tryCatch(readAllChunks(imageResponseReader));
+      if (imageReadError) {
+        logger.error("failed to read image response", { error: imageReadError });
+        return;
+      }
+
+      logger.debug("pulled image", { image: opts.image, imageResponse });
+    } else {
+      // Image is present, so we can use it to create the container
+    }
+
+    // Create container
+    const [createContainerError, container] = await tryCatch(
+      this.docker.createContainer({
+        ...containerCreateOpts,
+        // Add env vars here so they're not logged
+        Env: envVars,
+      })
+    );
 
-      this.logger.debug("create succeeded", {
-        opts,
-        startResult,
+    if (createContainerError) {
+      logger.error("Failed to create container", { error: createContainerError });
+      return;
+    }
+
+    // If there are multiple networks to attach to we need to attach the remaining ones after creation
+    if (remainingNetworks.length > 0) {
+      await this.attachContainerToNetworks({
         containerId: container.id,
-        containerCreateOpts,
+        networkNames: remainingNetworks,
       });
-    } catch (error) {
-      this.logger.error("create failed:", { opts, error, containerCreateOpts });
     }
+
+    // Start container
+    const [startError, startResult] = await tryCatch(container.start());
+
+    if (startError) {
+      logger.error("Failed to start container", { error: startError, containerId: container.id });
+      return;
+    }
+
+    logger.debug("create succeeded", { startResult, containerId: container.id });
   }
 
   private async attachContainerToNetworks({
@@ -173,3 +263,11 @@ export class DockerWorkloadManager implements WorkloadManager {
     });
   }
 }
+
+async function readAllChunks(reader: NodeJS.ReadableStream) {
+  const chunks = [];
+  for await (const chunk of reader) {
+    chunks.push(chunk.toString());
+  }
+  return chunks;
+}

apps/webapp/app/components/GitMetadata.tsx

@@ -8,8 +8,8 @@ export function GitMetadata({ git }: { git?: GitMetaLinks | null }) {
   return (
     <>
       {git.pullRequestUrl && git.pullRequestNumber && <GitMetadataPullRequest git={git} />}
-      {git.shortSha && <GitMetadataCommit git={git} />}
       {git.branchUrl && <GitMetadataBranch git={git} />}
+      {git.shortSha && <GitMetadataCommit git={git} />}
     </>
   );
 }

apps/webapp/app/entry.server.tsx

@@ -215,14 +215,20 @@ export { apiRateLimiter } from "./services/apiRateLimit.server";
 export { engineRateLimiter } from "./services/engineRateLimit.server";
 export { socketIo } from "./v3/handleSocketIo.server";
 export { wss } from "./v3/handleWebsockets.server";
-export { registryProxy } from "./v3/registryProxy.server";
 export { runWithHttpContext } from "./services/httpAsyncStorage.server";
 import { eventLoopMonitor } from "./eventLoopMonitor.server";
 import { env } from "./env.server";
 import { logger } from "./services/logger.server";
 import { Prisma } from "./db.server";
 import { registerRunEngineEventBusHandlers } from "./v3/runEngineHandlers.server";
+import { remoteBuildsEnabled } from "./v3/remoteImageBuilder.server";
 
 if (env.EVENT_LOOP_MONITOR_ENABLED === "1") {
   eventLoopMonitor.enable();
 }
+
+if (remoteBuildsEnabled()) {
+  console.log("🏗️  Remote builds enabled");
+} else {
+  console.log("🏗️  Local builds enabled");
+}