buildInstallation ran nixpacks against whatever was cloned at draft
creation time and never re-synced — every "rebuild" from the panel
silently rebuilt the same old commit forever, even after pushing new
commits. Confirmed repeatedly while iterating against a live repo
(had to git pull manually each time to actually pick up a fix).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
nixpacks doesn't read NIXPACKS_* config from the process environment
at all, only from -e/--env on its own CLI — the "fix" from the
previous commit was silently a no-op (nixpacks plan still showed
nodejs_18 for a repo pinned to 20 that way). Caught because the first
real container built with it still crashed the same way.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Nixpacks' current default (18) predates stable globalThis.crypto —
confirmed in production against ZenvairoSocial-MCP (no .nvmrc/engines.node
at all): build succeeded, container crashed immediately with "crypto is
not defined". A repo with its own version hint still wins; this only
changes the fallback for repos with none.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A global body parser drained every incoming request body, including
on the /mcp/:slug proxy route, before http-proxy could forward it —
every proxied POST reached the backend with zero body bytes and hung
forever. This broke the proxy for every real MCP call, caught only
once a container was actually tested through it end-to-end.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Some hosts can't enforce cgroup limits for nested containers at all
(confirmed on an OpenRC-based unprivileged LXC with no systemd to
delegate cgroup controllers) — docker run fails outright trying to
write memory.max. 0 now skips requesting that cap instead of erroring
every deploy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
nixpacks shells out to `docker build`, which defaults to BuildKit;
without the buildx CLI plugin every build failed outright.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The manager image had git but not openssh-client, so ssh:// clones
failed outright ("cannot run ssh"). Install openssh-client, and mount
an SSH_DIR (key + known_hosts) into the container read-only so private
repos can actually authenticate — confirmed both gaps while deploying
against real private Zenvairo repos.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Nixpacks silently falls back to its own default Node version when a
repo doesn't match what it expects, instead of failing the build —
confirmed in practice as a green build that crashed at runtime on a
missing global. detectNodeVersion() reads the repo's own .nvmrc or
package.json engines.node and passes it through as
NIXPACKS_NODE_VERSION so the build actually uses what the repo
declares.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
