Let the entrypoint run one command, and say so for every command #23

2026-08-29T16:00:31-07:00

dejima-agent commented

2026-08-29 16:00:31 -07:00

Summary generated by LLM agent

Asked for as a documentation gap, and the documentation was the smaller half.

The documented setup did not work

docker compose run SERVICE CMD replaces the command and keeps the entrypoint. The entrypoint here is dejima-guard-loop, which ignored its arguments entirely. So this, from the setup section:

docker compose run --rm dejima-guard dejima-guard trust-host

ran dejima-guard-loop dejima-guard trust-host, discarded both words, and started an infinite check loop: a container the operator has to interrupt, printing a check every fifteen minutes, while they wait for a fingerprint that is never going to print. It went unnoticed because the only person running this reached for exec.

Arguments now mean "run this once". That also shortens the form, since the entrypoint is already the guard: docker compose run --rm dejima-guard accept is the whole of it, and naming the binary a second time passes it to itself as an argument.

Restoring the old entrypoint under the new tests hangs the suite rather than failing it, which is a fair description of the bug, so that test carries a timeout.

The prefix is now documented for every command

The Use section listed bare command names. That is the host path. On a container host there is no dejima-guard at all, or worse there is one from a second deployment with its own baseline and its own idea of what normal looks like.

Both forms are documented with the rule for choosing between them: exec into the container that is already there, run a new one when it is not. Plus a shell function for anyone tired of typing the prefix, pointed at wherever their compose file lives.

One test loosened on purpose

The --build rule is now scoped to the setup block. It is right for the commands that follow a git pull and wrong for a one-shot accept, which would rebuild the image every time somebody read a report. docker compose up still requires it anywhere it appears.

Tested: 115 passing, up from 111.

**Summary generated by LLM agent** Asked for as a documentation gap, and the documentation was the smaller half. ## The documented setup did not work `docker compose run SERVICE CMD` replaces the command and keeps the **entrypoint**. The entrypoint here is `dejima-guard-loop`, which ignored its arguments entirely. So this, from the setup section: ```sh docker compose run --rm dejima-guard dejima-guard trust-host ``` ran `dejima-guard-loop dejima-guard trust-host`, discarded both words, and started an infinite check loop: a container the operator has to interrupt, printing a check every fifteen minutes, while they wait for a fingerprint that is never going to print. It went unnoticed because the only person running this reached for `exec`. Arguments now mean "run this once". That also shortens the form, since the entrypoint is already the guard: `docker compose run --rm dejima-guard accept` is the whole of it, and naming the binary a second time passes it to itself as an argument. Restoring the old entrypoint under the new tests hangs the suite rather than failing it, which is a fair description of the bug, so that test carries a timeout. ## The prefix is now documented for every command The `Use` section listed bare command names. That is the host path. On a container host there is no `dejima-guard` at all, or worse there is one from a second deployment with its own baseline and its own idea of what normal looks like. Both forms are documented with the rule for choosing between them: `exec` into the container that is already there, `run` a new one when it is not. Plus a shell function for anyone tired of typing the prefix, pointed at wherever their compose file lives. ## One test loosened on purpose The `--build` rule is now scoped to the setup block. It is right for the commands that follow a `git pull` and wrong for a one-shot `accept`, which would rebuild the image every time somebody read a report. `docker compose up` still requires it anywhere it appears. Tested: 115 passing, up from 111.

dejima-agent added 1 commit 2026-08-29 16:00:32 -07:00

Let the entrypoint run one command, and say so for every command 21ebd4709e

`docker compose run SERVICE CMD` replaces the command and keeps the entrypoint.
The entrypoint here is dejima-guard-loop, which ignored its arguments - so the
documented setup step

    docker compose run --rm dejima-guard dejima-guard trust-host

discarded both words and started an infinite check loop, in a container the
operator had to interrupt, while they waited for a fingerprint that was never
going to print. Nobody hit it because the only person running this used exec.

Arguments now mean "run this once", which also shortens the form: the entrypoint
is already the guard, so `run --rm dejima-guard accept` is the whole of it.
Naming the binary again passes it to itself.

The Use section listed bare command names, which is the host path. On a
container host there is no dejima-guard at all, or worse there is one from a
second deployment with its own baseline. Both container forms are documented
with the rule for choosing: exec into the container that is already there, run
a new one when it is not. Plus a shell function for anyone tired of the prefix.

The rebuild test is scoped to the setup block now. --build is right for the
commands that follow a git pull and wrong for a one-shot accept, which would
rebuild the image every time somebody read a report.

branderson approved these changes 2026-08-29 16:19:13 -07:00

branderson merged commit df590bf8c9 into main

2026-08-29 16:19:17 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-guard#23