@tdk-landscape/tdk-cli-core 1.3.49 → 1.3.50

package/engine/assets/docker/wake-gateway/server.ts

@@ -0,0 +1,220 @@
+/**
+ * Wake gateway: fronts every `sablier.deferStart` resource's Traefik static
+ * route (see openspec/changes/prioritized-cold-start). On the first request
+ * for a resource with no running container, it triggers the resource (and
+ * its cold dependencies) via `tilt trigger`, and/or Sablier's own start for
+ * an already-created container, then holds the request until the resource
+ * answers its healthcheck or the configured timeout elapses.
+ *
+ * Config for each request comes from headers a Traefik `headers` middleware
+ * injects (set by the file-provider entry generated in
+ * traefik_static_routes.star) rather than the path, so the original request
+ * path/query reach the real backend unchanged once it's ready:
+ *   X-Wake-Resource        Tilt/Compose resource name (for `tilt trigger`,
+ *                          and the proxy target -- Compose's embedded DNS
+ *                          resolves a service by this name too).
+ *   X-Wake-Container       The actual Docker container name (for `docker
+ *                          inspect` state/health -- NOT the same string as
+ *                          the resource name; Compose derives it as
+ *                          <project>-<service>-<replica>, confirmed empirically
+ *                          against a live TDK container, e.g.
+ *                          "analytics-autogenerated-data-governance-api-1"
+ *                          for the "data-governance-api" resource).
+ *   X-Wake-Deps            Comma-separated "resourceName=containerName" pairs
+ *                          for required dependencies (task 1.5: Tilt never
+ *                          cascades a trigger to these on its own).
+ *   X-Wake-Timeout-Ms, X-Wake-Proxy-Port, X-Wake-Session-Duration
+ */
+import { decideWakeAction, evaluateReadiness, type ContainerState } from "./decide";
+
+const TILT_HOST = process.env.TILT_HOST || "host.docker.internal";
+const TILT_PORT = process.env.TILT_PORT || "10350";
+const SABLIER_URL = process.env.SABLIER_URL || "http://sablier:10000";
+const POLL_INTERVAL_MS = 1000;
+const DEFAULT_TIMEOUT_MS = 60_000;
+
+async function run(cmd: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
+  const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { code, stdout, stderr };
+}
+
+async function containerState(name: string): Promise<ContainerState> {
+  const { code, stdout } = await run([
+    "docker", "inspect", "--format", "{{.State.Status}}", name,
+  ]);
+  if (code !== 0) return "absent";
+  const status = stdout.trim();
+  if (status === "running") return "running";
+  if (status === "created") return "created";
+  return "exited";
+}
+
+async function isHealthy(name: string): Promise<boolean> {
+  const { code, stdout } = await run([
+    "docker", "inspect",
+    "--format", "{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}",
+    name,
+  ]);
+  if (code !== 0) return false;
+  const status = stdout.trim();
+  return status === "healthy" || status === "running";
+}
+
+async function tiltTrigger(name: string): Promise<void> {
+  await run(["tilt", "trigger", name, "--host", TILT_HOST, "--port", TILT_PORT]);
+}
+
+/**
+ * Sablier's real blocking-strategy endpoint (GET /api/strategies/blocking,
+ * per https://sablierapp.dev/openapi.json): starts the named instance and
+ * holds until it's ready or `timeoutMs` elapses, returning that outcome via
+ * the X-Sablier-Session-Status header. Only valid for an instance Sablier
+ * already knows about (a container that exists with sablier.enable=true) --
+ * see decide.ts's useSablierStart.
+ */
+async function sablierBlockingWait(resource: string, sessionDuration: string, timeoutMs: number): Promise<boolean> {
+  const params = new URLSearchParams({
+    names: resource,
+    session_duration: sessionDuration,
+    timeout: `${Math.max(1, Math.round(timeoutMs / 1000))}s`,
+  });
+  try {
+    const res = await fetch(`${SABLIER_URL}/api/strategies/blocking?${params}`);
+    return res.headers.get("X-Sablier-Session-Status") === "ready";
+  } catch {
+    return false;
+  }
+}
+
+interface NamedDep {
+  resourceName: string;
+  containerName: string;
+}
+
+function parseDeps(raw: string): NamedDep[] {
+  return raw
+    .split(",")
+    .filter(Boolean)
+    .map((pair) => {
+      const [resourceName, containerName] = pair.split("=");
+      return { resourceName, containerName: containerName || resourceName };
+    });
+}
+
+function parseRequest(req: Request) {
+  const resource = req.headers.get("X-Wake-Resource") || "";
+  const container = req.headers.get("X-Wake-Container") || resource;
+  const deps = parseDeps(req.headers.get("X-Wake-Deps") || "");
+  const timeoutMs = Number(req.headers.get("X-Wake-Timeout-Ms")) || DEFAULT_TIMEOUT_MS;
+  const proxyPort = req.headers.get("X-Wake-Proxy-Port") || "80";
+  const sessionDuration = req.headers.get("X-Wake-Session-Duration") || "10m";
+  return { resource, container, deps, timeoutMs, proxyPort, sessionDuration };
+}
+
+async function handleWake(req: Request): Promise<Response> {
+  const { resource, container, deps, timeoutMs, proxyPort, sessionDuration } = parseRequest(req);
+  if (!resource) {
+    return new Response("wake gateway: missing X-Wake-Resource header (set by the generated Traefik static route)", { status: 400 });
+  }
+
+  const resourceState = await containerState(container);
+  const dependencies = await Promise.all(
+    deps.map(async (dep) => ({ name: dep.resourceName, state: await containerState(dep.containerName) })),
+  );
+
+  const action = decideWakeAction({ resourceContainerName: resource, resourceState, dependencies });
+  const deadline = Date.now() + timeoutMs;
+
+  // tilt trigger runs for everything cold (task 1.5: Tilt never cascades this
+  // on its own); Sablier's blocking call, when applicable, both starts AND
+  // waits for the resource itself in one round trip.
+  const [, resourceReadyViaSablier] = await Promise.all([
+    Promise.all(action.tiltTriggerNames.map(tiltTrigger)),
+    action.useSablierStart
+      ? sablierBlockingWait(resource, sessionDuration, timeoutMs)
+      : Promise.resolve(false),
+  ]);
+
+  const requiredNames = [resource, ...deps.map((d) => d.resourceName)];
+  const containerByName: Record<string, string> = { [resource]: container };
+  for (const dep of deps) containerByName[dep.resourceName] = dep.containerName;
+
+  while (Date.now() < deadline) {
+    const healthy: Record<string, boolean> = {};
+    // Sablier's blocking call already confirmed the resource itself; re-check
+    // it too (cheap) so a false result from Sablier still gets a fair retry.
+    healthy[resource] = resourceReadyViaSablier || (await isHealthy(container));
+    for (const dep of deps) {
+      healthy[dep.resourceName] = await isHealthy(dep.containerName);
+    }
+    const outcome = evaluateReadiness(requiredNames, healthy);
+    if (outcome.ready) {
+      return proxyThrough(req, resource, proxyPort);
+    }
+    await Bun.sleep(POLL_INTERVAL_MS);
+  }
+
+  return new Response(
+    `wake gateway: timed out after ${timeoutMs}ms waiting for ${resource} and its dependencies to become healthy`,
+    { status: 504 },
+  );
+}
+
+// Headers that must not be forwarded verbatim to the upstream fetch: Host
+// would otherwise carry the gateway's own address, and the X-Wake-* control
+// headers are gateway-internal, not part of the real app request.
+const STRIPPED_REQUEST_HEADERS = new Set([
+  "host",
+  "x-wake-resource",
+  "x-wake-container",
+  "x-wake-deps",
+  "x-wake-timeout-ms",
+  "x-wake-proxy-port",
+  "x-wake-session-duration",
+]);
+
+async function proxyThrough(req: Request, resource: string, port: string): Promise<Response> {
+  // The original path/query reach the gateway untouched (config travels via
+  // X-Wake-* headers, not the path), so they're forwarded as-is.
+  const target = new URL(req.url);
+  target.protocol = "http:";
+  // Set hostname/port separately, not via `.host` -- confirmed empirically
+  // that `target.host = "name:port"` silently keeps the URL's original port
+  // when one is already present instead of replacing it.
+  target.hostname = resource;
+  target.port = port;
+
+  const headers = new Headers();
+  for (const [key, value] of req.headers) {
+    if (!STRIPPED_REQUEST_HEADERS.has(key.toLowerCase())) headers.set(key, value);
+  }
+
+  const upstream = await fetch(target.toString(), {
+    method: req.method,
+    headers,
+    body: req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer(),
+  });
+  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
+}
+
+Bun.serve({
+  port: Number(process.env.PORT) || 9999,
+  // Bun's default idleTimeout (10s) is shorter than a real wake can take
+  // (tilt trigger + healthcheck polling) -- confirmed empirically: a request
+  // was killed mid-wait with "request timed out after 10 seconds" before this
+  // was raised. 255s is Bun's own max for this setting.
+  idleTimeout: 255,
+  fetch(req) {
+    return handleWake(req).catch((err) => {
+      console.error("wake gateway error:", err);
+      return new Response(`wake gateway error: ${String(err)}`, { status: 500 });
+    });
+  },
+});
+
+console.log(`wake gateway listening on :${Number(process.env.PORT) || 9999}`);

package/engine/topologies/platform/docker/build/golden_image_dockerfile.star

@@ -2,16 +2,8 @@
 # 🏗️ TILT SDK - GOLDEN IMAGE DOCKERFILE GENERATOR
 # =============================================================================
 
-# === INLINED CONSTANTS for pure extension loading ===
-get_docker_healthcheck_config = lambda: {"path": "/health", "interval_seconds": 10, "timeout_seconds": 5, "start_period_seconds": 30, "retries": 3, "frontend_start_period_seconds": 30}
-# === END INLINED CONSTANTS ===
-
-
 load('../../../tilt/common/utils.star', 'Utils')
-
-
-# Load centralized healthcheck configuration
-_docker_health = get_docker_healthcheck_config()
+load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck_flags')
 
 
 # Load project name for dynamic naming
@@ -76,7 +68,6 @@ RUN apk add --no-cache \
     ca-certificates \
     tzdata \
     curl \
-    file \
     bash \
     openssl
 
@@ -180,9 +171,11 @@ LABEL layer="l4-backend-bun" \
       maintainer="{prefix}"
 
 ENV NODE_ENV=production
+# Smaller heap growth and more frequent GC: idle services dominate a 100-service landscape.
+ENV BUN_OPTIONS=--smol
 
-# Install hugo for services that require static site generation (specified via manifest features)
-RUN apk add --no-cache hugo
+# Service-specific tooling (e.g. hugo) is installed per service by the L4 runtime
+# layer when the manifest lists it in featuresEnabled - not here for every backend.
 
 # ⚠️ Infisical CLI is NOT installed in golden L4 images
 # Services use TypeScript SDK (fetch API) or read from env vars - no CLI needed
@@ -192,7 +185,7 @@ RUN apk add --no-cache hugo
 USER bun
 
 # Backend-specific healthcheck (checks Bun runtime)
-HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={start_period}s --retries={retries} \
+HEALTHCHECK {hc_flags} \
   CMD bun --version || exit 1
 
 WORKDIR /app
@@ -221,7 +214,7 @@ RUN addgroup -S app && adduser -S app -G app
 USER app
 
 # Backend-specific healthcheck (checks Node.js runtime)
-HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={start_period}s --retries={retries} \
+HEALTHCHECK {hc_flags} \
   CMD node --version || exit 1
 
 WORKDIR /app
@@ -246,7 +239,7 @@ ENV NODE_ENV=production
 RUN apk add --no-cache curl
 
 # Frontend-specific healthcheck (checks Nginx)
-HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={frontend_start_period}s --retries={retries} \
+HEALTHCHECK {hc_flags_frontend} \
   CMD curl -f http://localhost/ || exit 1
 
 WORKDIR /usr/share/nginx/html
@@ -276,16 +269,13 @@ RUN mkdir -p /cache/bun && chown -R bun:bun /cache/bun
 
 USER bun
 
-# Migrator-specific healthcheck (checks Prisma CLI)
-HEALTHCHECK --interval={interval}s --timeout={timeout}s --start-period={start_period}s --retries={retries} \
-  CMD bunx prisma --version || exit 1
+# Migrators are one-shot jobs (migrate.sh runs to completion), so no healthcheck.
+# The per-service l4_migrator_runtime stage sets HEALTHCHECK NONE as well.
+HEALTHCHECK NONE
 
 WORKDIR /app
 """.format(
-    interval=_docker_health["interval_seconds"],
-    timeout=_docker_health["timeout_seconds"],
-    start_period=_docker_health["start_period_seconds"],
-    retries=_docker_health["retries"],
-    frontend_start_period=_docker_health["frontend_start_period_seconds"],
+    hc_flags=dockerfile_healthcheck_flags(),
+    hc_flags_frontend=dockerfile_healthcheck_flags(DOCKER_HEALTHCHECK["frontend_start_period_seconds"]),
     prefix=_GOLDEN_PREFIX,
 )

package/engine/topologies/platform/docker/compose/compose.star

@@ -23,6 +23,7 @@ load("../secrets/infisical.star", "get_infisical_environment_vars")
 load("../auth/auth.star", "AuthConfig")
 
 load("../constants.star", "PlatformDockerConstants")
+load("../config/healthcheck.star", "DOCKER_HEALTHCHECK", "compose_healthcheck_timing")
 
 # Load project name for dynamic host naming
 # Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
@@ -125,6 +126,7 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
     
     return """  {res_name}:
     image: {image_name}
+    init: true
 {build_config}
     <<: *frontend-memory-limit
     env_file:
@@ -138,12 +140,7 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
         - {network_backend}
     healthcheck:
       test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:{port}"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      # STORY 4 FIX: 30s grace period to prevent 504 errors on startup
-      start_period: 30s
-""".format(
+{healthcheck_timing}""".format(
         res_name=res_name, 
         image_name=image_name,
         build_config=build_config,
@@ -152,6 +149,7 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
         port=port,
         network_traefik_public=PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,
         network_backend=PlatformDockerConstants.NETWORK_BACKEND,
+        healthcheck_timing=compose_healthcheck_timing(DOCKER_HEALTHCHECK["frontend_start_period_seconds"]),
     )
 
 
@@ -261,13 +259,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         )
         healthcheck_section = """    healthcheck:
       test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      # STORY 4 FIX: 30s grace period to prevent 504 errors during startup
-      # Services get 30s to initialize before health checks begin
-      start_period: 30s
-""".format(internal_port=internal_port, health_path=health_path)
+""".format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     infisical_env = get_infisical_environment_vars(as_array=True, resource_name=res_name)
     
     # Build auth environment variables section using centralized auth utilities
@@ -275,6 +267,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     return """
   {resource_entry_name}:
     image: {image_name}
+    init: true
     restart: unless-stopped
 {build_config}
 {ports_section}
@@ -619,7 +612,7 @@ services:
   {migrator_name}:
     image: {image_name}
     build:
-      context: ../../../../.
+      context: ../../../.
       dockerfile: {dockerfile_ref}
       target: migrator
     environment:

package/engine/topologies/platform/docker/compose/compose_helpers.star

@@ -40,7 +40,7 @@ def compose_build_config(resource_path, res_name, dockerfile=OUTPUT.AUTOGENERATE
         )
     
     base_config = """    build:
-      context: ../../../../.
+      context: ../../../.
       dockerfile: {full_dockerfile_path}""".format(
         full_dockerfile_path=full_dockerfile_path
     )

package/engine/topologies/platform/docker/compose/traefik_standalone.star

@@ -6,6 +6,7 @@
 # skip Traefik entirely and api.{project}.localhost never served.
 
 load("../constants.star", "PlatformDockerConstants")
+load("../config/healthcheck.star", "compose_healthcheck_timing")
 
 
 def generate_standalone_traefik_compose():
@@ -24,6 +25,7 @@ services:
     restart: unless-stopped
     depends_on:
       - sablier
+      - wake-gateway
     command:
       - "--api.insecure=true"
       - "--ping=true"
@@ -31,6 +33,13 @@ services:
       - "--providers.docker.exposedbydefault=false"
       - "--providers.docker.watch=true"
       - "--providers.docker.network={network}"
+      # Static routes for sablier.deferStart resources (openspec/changes/
+      # prioritized-cold-start): a never-created resource has no container
+      # and thus no Docker labels for the provider above to discover, so its
+      # route is defined here instead, pointed at wake-gateway. Harmless when
+      # no deferStart resource exists (empty directory, no routes emitted).
+      - "--providers.file.directory=/etc/traefik/dynamic"
+      - "--providers.file.watch=true"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--log.level=INFO"
@@ -44,15 +53,12 @@ services:
       - "8080:8080"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./{dynamic_dir_name}:/etc/traefik/dynamic:ro
     networks:
       - traefik-public
     healthcheck:
       test: ["CMD", "traefik", "healthcheck", "--ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      start_period: 10s
-
+{healthcheck_timing}
   sablier:
     image: sablierapp/sablier:1.18.0
     container_name: {name}_sablier
@@ -66,8 +72,40 @@ services:
     networks:
       - traefik-public
 
+  # Wake gateway (openspec/changes/prioritized-cold-start): fronts every
+  # deferStart resource's static route above. Triggers a cold resource (and
+  # its dependencies, which Tilt never cascades to on its own -- see design.md
+  # D3/task 1.5) via `tilt trigger`, or Sablier's own start when a container
+  # already exists, then holds the request until healthy. Needs the same
+  # Tilt session token Sablier/Traefik don't: confirmed empirically that
+  # `tilt trigger` from inside a container is otherwise rejected with
+  # "(403): invalid session token" even when the Tilt HTTP port is reachable.
+  wake-gateway:
+    build: ./{vendored_gateway_dir}
+    container_name: {gateway_container}
+    restart: unless-stopped
+    environment:
+      - TILT_HOST=host.docker.internal
+      - TILT_PORT=10350
+      - SABLIER_URL=http://sablier:10000
+      - PORT={gateway_port}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - {tilt_dev_dir}:/root/.tilt-dev:ro
+    networks:
+      - traefik-public
+
 networks:
   traefik-public:
     name: {network}
     external: true
-""".format(name=name, network=network)
+""".format(
+        name=name,
+        network=network,
+        healthcheck_timing=compose_healthcheck_timing(10),
+        dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
+        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+        gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
+        gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
+        tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
+    )

package/engine/topologies/platform/docker/config/healthcheck.star

@@ -0,0 +1,56 @@
+# =============================================================================
+# Docker healthcheck timing - single source for golden images, L4 runtimes and
+# generated compose files.
+# =============================================================================
+# Steady-state probes are infrequent (each probe is a `docker exec`, which adds
+# up across 100+ containers), while `start_interval` keeps first-healthy time
+# fast during the start period. `start_interval` needs Docker Engine 25+ and
+# Compose 2.20.2+ (checked by `tdk doctor`).
+#
+# Override per run with environment variables, e.g.:
+#   TDK_HEALTHCHECK_INTERVAL_SECONDS=15 tdk up
+# =============================================================================
+
+
+def _env_int(name, default):
+    raw = os.environ.get(name, '')
+    if raw and raw.isdigit() and int(raw) > 0:
+        return int(raw)
+    return default
+
+
+DOCKER_HEALTHCHECK = {
+    "path": "/health",
+    "interval_seconds": _env_int("TDK_HEALTHCHECK_INTERVAL_SECONDS", 30),
+    "start_interval_seconds": _env_int("TDK_HEALTHCHECK_START_INTERVAL_SECONDS", 2),
+    "timeout_seconds": _env_int("TDK_HEALTHCHECK_TIMEOUT_SECONDS", 5),
+    "start_period_seconds": _env_int("TDK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
+    "frontend_start_period_seconds": _env_int("TDK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
+    "retries": _env_int("TDK_HEALTHCHECK_RETRIES", 3),
+}
+
+
+def dockerfile_healthcheck_flags(start_period_seconds = None):
+    """Flags for a Dockerfile `HEALTHCHECK` instruction."""
+    h = DOCKER_HEALTHCHECK
+    start_period = start_period_seconds if start_period_seconds != None else h["start_period_seconds"]
+    return "--interval={}s --start-interval={}s --timeout={}s --start-period={}s --retries={}".format(
+        h["interval_seconds"],
+        h["start_interval_seconds"],
+        h["timeout_seconds"],
+        start_period,
+        h["retries"],
+    )
+
+
+def compose_healthcheck_timing(start_period_seconds = None, indent = "      "):
+    """Timing keys for a compose `healthcheck:` block (everything except `test:`)."""
+    h = DOCKER_HEALTHCHECK
+    start_period = start_period_seconds if start_period_seconds != None else h["start_period_seconds"]
+    return (
+        indent + "interval: {}s\n".format(h["interval_seconds"])
+        + indent + "timeout: {}s\n".format(h["timeout_seconds"])
+        + indent + "retries: {}\n".format(h["retries"])
+        + indent + "start_period: {}s\n".format(start_period)
+        + indent + "start_interval: {}s\n".format(h["start_interval_seconds"])
+    )

package/engine/topologies/platform/docker/constants.star

@@ -62,6 +62,13 @@ NETWORK_DATABASE = PROJECT_NAME + "_database"
 NETWORK_INFISICAL = PROJECT_NAME + "_infisical-network"
 NETWORK_PROXY = PROJECT_NAME + "_proxy"
 
+# Traefik file-provider dynamic config: one generated YAML per `sablier.deferStart`
+# resource's static route (see openspec/changes/prioritized-cold-start), mounted
+# read-only into the standalone Traefik container at /etc/traefik/dynamic.
+TRAEFIK_DYNAMIC_DIR_REL = ".tdk/.tdk-out/traefik-dynamic"
+TRAEFIK_WAKE_GATEWAY_CONTAINER = PROJECT_NAME_HYPHEN + "-wake-gateway"
+TRAEFIK_WAKE_GATEWAY_PORT = 9999
+
 # NATS constants
 NATS_HOST = PROJECT_NAME + "_nats"
 NATS_PORT = "4222"
@@ -146,6 +153,9 @@ PlatformDockerConstants = struct(
     NETWORK_DATABASE = NETWORK_DATABASE,
     NETWORK_INFISICAL = NETWORK_INFISICAL,
     NETWORK_PROXY = NETWORK_PROXY,
+    TRAEFIK_DYNAMIC_DIR_REL = TRAEFIK_DYNAMIC_DIR_REL,
+    TRAEFIK_WAKE_GATEWAY_CONTAINER = TRAEFIK_WAKE_GATEWAY_CONTAINER,
+    TRAEFIK_WAKE_GATEWAY_PORT = TRAEFIK_WAKE_GATEWAY_PORT,
     NATS_HOST = NATS_HOST,
     NATS_PORT = NATS_PORT,
     NATS_URL = NATS_URL,

package/engine/topologies/platform/docker/layers/l1_base_layers.star

@@ -61,7 +61,7 @@ def L1_generate_os_base(base_image = None, maintainer = None, use_golden = True)
         "# ---- L1: os_base (" + base_image + ") ----\n"
         + "FROM " + base_image + " AS l1_os_base\n"
         + "LABEL maintainer=\"" + maintainer + "\"\n"
-        + "RUN apk add --no-cache ca-certificates tzdata curl file bash openssl \\\n"
+        + "RUN apk add --no-cache ca-certificates tzdata curl bash openssl \\\n"
         + "    && addgroup -S app && adduser -S app -G app\n"
         + "WORKDIR /app\n"
     )