feat: 本番イメージの Nix build 化と ADR-0021 の Accepted 昇格（Phase 3）#501
Conversation
backend/Dockerfile の pip wheel 経路を全廃し、builder stage（nixos/nix）内で flake の backend-runtime（uv2nix build。devshell と同一の Python 環境 + WeasyPrint ライブラリ + cacert）を nix build して final stage（debian:12-slim） へ closure コピーする構成に変更。dev / CI / 本番の 3 経路のビルド機構を flake + uv.lock に一元化する。 - flake.nix: packages.backend-env / backend-runtime を出力に追加。 WeasyPrint ライブラリは lib.getLib で lib output を明示（glib の default output は bin のため）。cacert を同梱し SSL_CERT_FILE で参照（debian slim は ca-certificates 非同梱で libsql/rustls が起動時に失敗する） - aarch64-linux のみ libsql-experimental が sdist（Rust）ビルドとなるため、 Rust ツールチェーン等を override で注入（本番 amd64 は wheel のみで純粋） - build context をリポジトリルートへ変更（flake.nix 参照のため）。 docker-compose.yml / deploy.yml を追従し、ルートに .dockerignore を新設 - deploy-backend の timeout を 20→30 分に拡大（Nix レイヤ構築時間を考慮） - ADR-0021 を Accepted へ昇格（実装追記付き）。索引・ADR-0017（uv 非管理 前提）・ADR-0014（Renovate manager）・rules/backend/python.md を追従 検証: Apple Silicon で docker build → compose up → /health 200 を実機確認 （libsql Rust ビルド・alembic 適用・WeasyPrint import を通過）。make ci green。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 42 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe backend production image now uses a Nix-built runtime closure. Flake outputs provide the runtime, Docker builds from the repository root, and Compose and deployment workflows use the updated context. ADRs and backend dependency guidance reflect the accepted Nix-managed environment. ChangesBackend runtime image
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant CIOrCompose
participant Dockerfile
participant NixBuilder
participant RuntimeImage
participant SmokeBackend
CIOrCompose->>Dockerfile: build from repository root
Dockerfile->>NixBuilder: build .#backend-runtime
NixBuilder-->>Dockerfile: return runtime closure
Dockerfile->>RuntimeImage: copy closure and backend files
SmokeBackend->>RuntimeImage: start image and libsql
RuntimeImage-->>SmokeBackend: /health returns 200
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
feature
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.claude/rules/backend/python.md (1)
36-37: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPoint contributors to the shared native-library list.
flake.nixderives both the devshell library path andbackendRuntimefromweasyPrintLibs. Directing contributors to edit the generated consumers independently risks environment drift and may omitLD_LIBRARY_PATHwiring.Proposed clarification
-- Python ライブラリがシステムパッケージ（C ライブラリ等）に依存する場合、`flake.nix` の **devshell（`devShells.default.packages`）と本番ランタイム（`backendRuntime` の `paths`）の両方**に追加すること +- Python ライブラリがシステムパッケージ（C ライブラリ等）に依存する場合、`flake.nix` の共有ネイティブライブラリ一覧（現在の `weasyPrintLibs`）へ追加し、devshell の `makeLibraryPath` と `backendRuntime.paths` の両方へ反映されることを確認する🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/rules/backend/python.md around lines 36 - 37, Update the Python dependency guidance around the devshell and backendRuntime to direct contributors to the shared weasyPrintLibs native-library list in flake.nix. Instruct them to add required system libraries there rather than editing devShells.default.packages or backendRuntime.paths independently, preserving the shared LD_LIBRARY_PATH wiring.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.dockerignore:
- Around line 9-12: Update the .dockerignore backend rules by first re-including
backend/, then explicitly re-including each required directory and its contents
with !backend/... and !backend/.../** patterns for alembic_migrations, app, and
scripts. Keep backend/app/**/__pycache__ as the final exclusion so Docker COPY
includes the needed files while omitting caches.
In `@docs/adr/0014-renovate-dependency-automation.md`:
- Around line 31-34: Normalize both ADRs to reflect the completed dependency
migration: in docs/adr/0014-renovate-dependency-automation.md lines 31-34,
update stale Python ecosystem and manager descriptions to PEP 621/uv.lock and
the current manager, or explicitly mark them historical; in
docs/adr/0017-mutation-testing-and-slack-notifications.md lines 22-23, update
the preceding bullet and mutmut table to match the completed PEP 621/Nix
migration. Preserve the existing pinning behavior.
---
Nitpick comments:
In @.claude/rules/backend/python.md:
- Around line 36-37: Update the Python dependency guidance around the devshell
and backendRuntime to direct contributors to the shared weasyPrintLibs
native-library list in flake.nix. Instruct them to add required system libraries
there rather than editing devShells.default.packages or backendRuntime.paths
independently, preserving the shared LD_LIBRARY_PATH wiring.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dc1d685a-1f66-4fec-b75a-ed53bebf668a
📒 Files selected for processing (11)
.claude/rules/backend/python.md.dockerignore.github/workflows/deploy.yml.github/workflows/test.ymlbackend/Dockerfiledocker-compose.ymldocs/adr/0014-renovate-dependency-automation.mddocs/adr/0017-mutation-testing-and-slack-notifications.mddocs/adr/0021-nix-managed-python-env.mddocs/adr/README.mdflake.nix
BuildKit では旧形式でも動作するが、除外ディレクトリ配下の re-include を解釈しない ビルダー実装があるため、!backend/ → backend/* → 個別 re-include の標準形にする。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ADR-0014 / 0017 の requirements.txt 前提の記述が更新追記と矛盾して読めるため、 履歴であることを明示する（原文は書き換えず、履歴保持の ADR 規約に沿う）。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
変更概要
ADR-0021 の最終 Phase（Phase 3）: 本番イメージのビルドを pip → Nix build 化し、dev / CI / 本番の 3 経路のビルド機構を flake + uv.lock に一元化する。あわせて ADR-0021 を Accepted へ昇格し、関連 ADR（0017 / 0014）の前提記述を追従させる。
実現方式: Nix-in-Dockerfile
backend/Dockerfileを 2 段構成に書き換え:nixos/nix）:nix build .#backend-runtime— devshell と同一の uv2nix build（Python 3.13 + 全依存 + WeasyPrint ライブラリ + curl + cacert）debian:12-slim）: closure を/nix/storeへコピーし、/runtimesymlink 経由でPATH/LD_LIBRARY_PATH/SSL_CERT_FILEを固定パス参照dockerTools（pure Nix イメージ）ではなくこの方式にしたのは、macOS ローカルで linux イメージを
nix buildできず、make dev-build（docker compose）の開発フローを維持するため（ADR の実装追記に記録済み）。付随変更
docker-compose.yml/deploy.ymlを追従、ルートに whitelist 方式の.dockerignoreを新設libsql-experimentalは aarch64 wheel が PyPI に無く sdist（Rust）ビルドになるため、flake の override で Rust ツールチェーンを注入。--option sandbox false下で crates.io を取得する（従来 pip 経路と同等の妥協。本番 = amd64 は全依存 wheel でハッシュ検証付き）rules/backend/python.mdの「Dockerfile に apt 追加」ルールを「flake の backendRuntime に追加」へ更新セルフレビューチェックリスト
必須確認
make ciが pass している（ruff / pyright 0 errors / pytest 724 passed / vitest 382 passed / build-web）+make lint-adr-indexpass条件付き確認（該当する場合のみ N/A と記入）
app/schemas//app/routers/の変更なしweb/src/の変更なし破壊的変更
docker build backend/は不可、docker build -f backend/Dockerfile .へ）。compose / deploy.yml は追従済みのため運用影響なし。API 契約・DB スキーマは変更なしADR
make lint-adr-indexgreen）検証（実機）
docker compose up→/health200（alembic 適用・libSQL 接続・WeasyPrint import 通過）。イメージ 745MBSSL_CERT_FILE。② glib の default output に lib が無く libgobject 不発見 →lib.getLibで lib output 明示レビュー時の注目点
smoke-backendが本 PR の実質的な検証ゲート（amd64 経路はここで初実走。wheel のみなのでローカル arm より速いはず）deploy-backendの所要時間と Cloud Run 起動を要観察🤖 Generated with Claude Code
Summary by CodeRabbit