pneumo

M0: Local MinIO dev stack and parallel-safe e2e harness (ENG-242) #8

Merged

demi.dev 1w ago

targeting main from stoopkidddd/eng-242-m0-local-dev-stack-minio-env-example-and-parallel-safe-e2e

Merged opened by and assigned to

demi.dev 1w ago targeting main from stoopkidddd/eng-242-m0-local-dev-stack-minio-env-example-and-parallel-safe-e2e

Linear: https://linear.app/engineereddev/issue/ENG-242

What's in this PR:

docker-compose.yml: MinIO on 127.0.0.1:9000/9001 with dev CORS, plus minio-init (idempotent bucket pneumo). The server profile is commented out.
.env.example: the §12.3 names with fake dev values.
scripts/e2e/minio.ts:
- start / stop with unique pneumo-e2e-* containers on random ports, an env file per instance, and stale-container cleanup after 2 hours;
- native mode, used automatically when there's no Docker;
- startMinio() / stopMinio() APIs and SIGINT cleanup.
mise tasks dev:infra, dev and check:infra (compose config, Biome, and a strict type-check of the harness). check:infra is added to check.

Verify (lead, with clean node_modules):

pnpm install --frozen-lockfile → install exit=0
mise run dev:infra → exit 0 · eng-242-minio-1 healthy 127.0.0.1:9000-9001 · console http=200
minio.ts start --env-out /tmp/a.env → S3_ENDPOINT=http://127.0.0.1:32784
minio.ts start --env-out /tmp/b.env → S3_ENDPOINT=http://127.0.0.1:32783
docker ps --filter name=pneumo-e2e- → 2 containers · both stop → exit 0 · 0 left
mise run check:infra → exit 0 · mise run check → exit 0 · compose down → clean

omp also tested native mode with Homebrew minio and minio-mc.

Deviation (needs a decision): the official MinIO images can't be pulled anonymously any more. The lead confirmed:

docker pull minio/minio:latest → "pull access denied"
quay.io/minio/minio → "unauthorized"

The compose file and the Docker mode therefore use pinned bitnamilegacy/minio:2025.4.22-debian-12-r2 and bitnamilegacy/minio-client:2025.4.16-debian-12-r2. These are archived and get no updates. Native mode (Homebrew locally, nixpkgs in CI) builds from source, so it isn't affected.

Commits 2

M0: Preserve MinIO data across Compose restarts (ENG-242)

+4 -1

M0: Add local MinIO stack and isolated e2e harness (ENG-242)

+451 -1

Comments

v0 1w ago

demi.dev 1w ago

pneumo-reviewer — round 1 (v0) (Claude Opus 5.5, xhigh)

VERDICT: REQUEST_CHANGES

SUMMARY: The harness does what the issue asks, and every acceptance item was run by hand: concurrent isolated Docker instances on different ports, isolated native instances, automatic native mode without Docker, SIGINT cleanup in both modes, stop removing containers and volumes, and check:infra passing. One blocker: the dev MinIO's named volume is mounted one level above the data directory, so docker compose down followed by dev:infra wipes the dev bucket.

FINDINGS:

FIX often=4 bad=3 score=12 docker-compose.yml:15. minio-data:/bitnami/minio sits above the image's VOLUME /bitnami/minio/data, so an anonymous volume shadows it. Tested: an object put into the bucket was gone after down and up, and the old volumes were left dangling. Fix: mount minio-data:/bitnami/minio/data.
FILE score 4. dev:infra returns before minio-init has created the bucket.
FILE score 4. The images are pinned by tag in the archived bitnamilegacy namespace. Exposure is low (127.0.0.1, fake credentials); the risks are tag mutation, the namespace disappearing and about 504 MB of CI pulls. Pin digests and use native mode in CI.
FILE score 4. The 120 s execFile timeout also covers the first image pull.
FILE score 4. The entry guard fails silently through a symlinked path.
FILE score 4. The native port probe can race, and the health check doesn't confirm the instance is its own child; stdio is discarded.
FILE score 4. The compose project name is per worktree, so a second worktree's dev:infra hits "port is already allocated".

SPEC CHECK: §16.2 is mostly OK; the deviation is finding 1. §17, §12.3 and §4 are OK. The image choice needs no ADR (the spec names no image).

DOD CHECK: shellcheck path present; no Dockerfile or workflow (N/A); not a prod change. Scope is the 6 listed files. No real secrets; env files are written mode 0600; execFile uses argument arrays.

TESTS RUN: check:infra → 0; dev:infra healthy and the init is idempotent; concurrent Docker and native starts were isolated; error paths checked; SIGINT cleanup ×4; automatic native mode; the persistence test failed (finding 1); full cleanup verified.

Lead: FIX 1 goes to omp (round 2). FILE 2–7 are recorded on ENG-275 (triage), ENG-278 (CI: native mode, pull timeout) and ENG-247 (bucket readiness).

v1 1w ago

demi.dev 1w ago

pneumo-reviewer — round 2 (v1) (Claude Opus 5.5, xhigh)

VERDICT: APPROVE

SUMMARY: FIX 1 is resolved. The named volume is mounted at /bitnami/minio/data, and /certs is a tmpfs, so the image creates no anonymous volumes. An object put before docker compose down (without -v) was intact after mise run dev:infra. The rebase is clean: range-diff shows 7471c7e = 7b8bc63, and the diff is still the 6 in-scope files. No new findings.

FINDINGS: Round-1 FIX 1 is RESOLVED (docker-compose.yml:15-17). docker inspect shows a single mount, eng-242_minio-data -> /bitnami/minio/data; /certs is a tmpfs, which is harmless because the minio entrypoint doesn't read it. FILE findings 2–7 are unchanged and recorded on ENG-275, ENG-278 and ENG-247.

SPEC CHECK: §16.2 OK (the dev store persists), §17 OK, §12.3 OK (one comment line added), §4 OK.

DOD CHECK: shellcheck path present; hadolint, docker build, workflows and prod are N/A. Scope: round 2 touches only docker-compose.yml and .env.example.

TESTS RUN: range-diff; dev:infra → 0 (minio healthy, minio-init exited 0); mount inspection; persistence (put, down, up, cat → "persist-r2"); check:infra → 0; Docker-mode e2e start and stop → 0; down --volumes → 0 dangling. Cleanup verified.

Versions