sst 2.24.22 → 2.24.24

package/constructs/Function.d.ts

@@ -566,6 +566,19 @@ export interface ContainerProps {
      * ```
      */
     file?: string;
+    /**
+     * Build args to pass to the docker build command.
+     * @default No build args
+     * @example
+     * ```js
+     * container: {
+     *   buildArgs: {
+     *     FOO: "bar"
+     *   }
+     * }
+     * ```
+     */
+    buildArgs?: Record<string, string>;
 }
 /**
  * Used to configure additional files to copy into the function bundle

package/constructs/Function.js

@@ -206,6 +206,9 @@ export class Function extends CDKFunction {
                             ...(props.container?.file
                                 ? { file: props.container.file }
                                 : {}),
+                            ...(props.container?.buildArgs
+                                ? { buildArgs: props.container.buildArgs }
+                                : {}),
                             exclude: [".sst"],
                             ignoreMode: IgnoreMode.GLOB,
                         }),

package/constructs/Job.d.ts

@@ -31,6 +31,19 @@ export interface JobContainerProps {
      * ```
      */
     file?: string;
+    /**
+     * Build args to pass to the docker build command.
+     * @default No build args
+     * @example
+     * ```js
+     * container: {
+     *   buildArgs: {
+     *     FOO: "bar"
+     *   }
+     * }
+     * ```
+     */
+    buildArgs?: Record<string, string>;
 }
 export interface JobProps {
     /**

package/constructs/Job.js

@@ -213,6 +213,7 @@ export class Job extends Construct {
                         ? Platform.custom("linux/arm64")
                         : Platform.custom("linux/amd64"),
                     file: container?.file,
+                    buildArgs: container?.buildArgs,
                     exclude: [".sst"],
                     ignoreMode: IgnoreMode.GLOB,
                 });

package/constructs/NextjsSite.d.ts

@@ -63,7 +63,7 @@ export declare class NextjsSite extends SsrSite {
     private createWarmer;
     protected createCloudFrontDistributionForRegional(): Distribution;
     protected createCloudFrontDistributionForEdge(): Distribution;
-    protected buildServerCachePolicy(): CachePolicy;
+    protected useServerBehaviorCachePolicy(): CachePolicy;
     private buildImageBehavior;
     protected generateBuildId(): string;
     getConstructMetadata(): {

package/constructs/NextjsSite.js

@@ -255,8 +255,7 @@ export class NextjsSite extends SsrSite {
          */
         const { customDomain, cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
-        const cachePolicy = cdk?.serverCachePolicy ?? this.buildServerCachePolicy();
-        const serverBehavior = this.buildDefaultBehaviorForRegional(cachePolicy);
+        const serverBehavior = this.buildDefaultBehaviorForRegional();
         return new Distribution(this, "CDN", {
             scopeOverride: this,
             customDomain,
@@ -271,7 +270,7 @@ export class NextjsSite extends SsrSite {
                     additionalBehaviors: {
                         "api/*": serverBehavior,
                         "_next/data/*": serverBehavior,
-                        "_next/image*": this.buildImageBehavior(cachePolicy),
+                        "_next/image*": this.buildImageBehavior(),
                         ...(cfDistributionProps.additionalBehaviors || {}),
                     },
                 },
@@ -281,8 +280,7 @@ export class NextjsSite extends SsrSite {
     createCloudFrontDistributionForEdge() {
         const { customDomain, cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
-        const cachePolicy = cdk?.serverCachePolicy ?? this.buildServerCachePolicy();
-        const serverBehavior = this.buildDefaultBehaviorForEdge(cachePolicy);
+        const serverBehavior = this.buildDefaultBehaviorForEdge();
         return new Distribution(this, "CDN", {
             scopeOverride: this,
             customDomain,
@@ -297,15 +295,15 @@ export class NextjsSite extends SsrSite {
                     additionalBehaviors: {
                         "api/*": serverBehavior,
                         "_next/data/*": serverBehavior,
-                        "_next/image*": this.buildImageBehavior(cachePolicy),
+                        "_next/image*": this.buildImageBehavior(),
                         ...(cfDistributionProps.additionalBehaviors || {}),
                     },
                 },
             },
         });
     }
-    buildServerCachePolicy() {
-        return super.buildServerCachePolicy([
+    useServerBehaviorCachePolicy() {
+        return super.useServerBehaviorCachePolicy([
             "accept",
             "rsc",
             "next-router-prefetch",
@@ -313,7 +311,7 @@ export class NextjsSite extends SsrSite {
             "next-url",
         ]);
     }
-    buildImageBehavior(cachePolicy) {
+    buildImageBehavior() {
         const { cdk, regional } = this.props;
         const imageFn = this.createImageOptimizationFunction();
         const imageFnUrl = imageFn.addFunctionUrl({
@@ -327,7 +325,7 @@ export class NextjsSite extends SsrSite {
             allowedMethods: AllowedMethods.ALLOW_ALL,
             cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
-            cachePolicy,
+            cachePolicy: cdk?.serverCachePolicy ?? this.useServerBehaviorCachePolicy(),
             responseHeadersPolicy: cdk?.responseHeadersPolicy,
             edgeLambdas: regional?.enableServerUrlIamAuth
                 ? [

package/constructs/RemixSite.d.ts

@@ -20,6 +20,7 @@ export declare class RemixSite extends SsrSite {
         serverBuildOutputFile: string;
         clientBuildOutputDir: string;
         clientBuildVersionedSubDir: string;
+        clientCFFunctionInjection: string;
     };
     private createServerLambdaBundle;
     protected createFunctionForRegional(): SsrFunction;

package/constructs/RemixSite.js

@@ -53,6 +53,11 @@ export class RemixSite extends SsrSite {
             serverBuildOutputFile: "build/index.js",
             clientBuildOutputDir: "public",
             clientBuildVersionedSubDir: "build",
+            // Note: When using libraries like remix-flat-routes the file can
+            // contains special characters like "+". It needs to be encoded.
+            clientCFFunctionInjection: `
+       request.uri = request.uri.split('/').map(encodeURIComponent).join('/');
+      `,
         };
     }
     createServerLambdaBundle(wrapperFile) {

package/constructs/Service.d.ts

@@ -4,8 +4,9 @@ import { SSTConstruct } from "./Construct.js";
 import { Permissions } from "./util/permission.js";
 import { FunctionBindingProps } from "./util/functionBinding.js";
 import { IVpc } from "aws-cdk-lib/aws-ec2";
-import { Cluster, ContainerDefinitionOptions } from "aws-cdk-lib/aws-ecs";
+import { Cluster, ContainerDefinitionOptions, CpuArchitecture, FargateServiceProps } from "aws-cdk-lib/aws-ecs";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
+import { ApplicationTargetGroupProps } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 declare const supportedCpus: {
     "0.25 vCPU": number;
     "0.5 vCPU": number;
@@ -29,7 +30,18 @@ export interface ServiceProps {
      */
     file?: string;
     /**
-     * The amount of cpu allocated.
+     * The CPU architecture of the container.
+     * @default "x86_64"
+     * @example
+     * ```js
+     * {
+     *   architecture: "arm64",
+     * }
+     * ```
+     */
+    architecture?: Lowercase<keyof Pick<typeof CpuArchitecture, "ARM64" | "X86_64">>;
+    /**
+     * The amount of CPU allocated.
      * @default "0.25 vCPU"
      * @example
      * ```js
@@ -214,6 +226,23 @@ export interface ServiceProps {
      * ```
      */
     waitForInvalidation?: boolean;
+    build?: {
+        /**
+         * Build args to pass to the docker build command.
+         * @default No build args
+         * @example
+         * ```js
+         * {
+         *   build: {
+         *     buildArgs: {
+         *       FOO: "bar"
+         *     }
+         *   }
+         * }
+         * ```
+         */
+        buildArgs?: Record<string, string>;
+    };
     dev?: {
         /**
          * When running `sst dev, site is not deployed. This is to ensure `sst dev` can start up quickly.
@@ -248,7 +277,9 @@ export interface ServiceProps {
          * @example
          * ```js
          * {
-         *   cloudfrontDistribution: false
+         *   cdk: {
+         *     cloudfrontDistribution: false
+         *   }
          * }
          * ```
          */
@@ -259,11 +290,44 @@ export interface ServiceProps {
          * @example
          * ```js
          * {
-         *   applicationLoadBalancer: false
+         *   cdk: {
+         *     applicationLoadBalancer: false
+         *   }
          * }
          * ```
          */
         applicationLoadBalancer?: boolean;
+        /**
+         * Customize the Application Load Balancer's target group.
+         * @default true
+         * @example
+         * ```js
+         * {
+         *   cdk: {
+         *     applicationLoadBalancerTargetGroup: {
+         *       healthCheck: {
+         *         path: "/health"
+         *       }
+         *     }
+         *   }
+         * }
+         * ```
+         */
+        applicationLoadBalancerTargetGroup?: ApplicationTargetGroupProps;
+        /**
+         * Customize the Fargate Service.
+         * @example
+         * ```js
+         * {
+         *   cdk: {
+         *     fargateService: {
+         *       circuitBreaker: { rollback: true }
+         *     }
+         *   }
+         * }
+         * ```
+         */
+        fargateService?: Omit<FargateServiceProps, "cluster" | "taskDefinition">;
         /**
          * Customizing the container definition for the ECS task.
          * @example
@@ -272,14 +336,16 @@ export interface ServiceProps {
          *   cdk: {
          *     container: {
          *       healthCheck: {
-         *         command: ["CMD-SHELL", "curl -f http://localhost/ || exit 1"],
-         *       },
+         *         command: ["CMD-SHELL", "curl -f http://localhost/ || exit 1"]
+         *       }
          *     }
          *   }
          * }
          * ```
          */
-        container?: Omit<ContainerDefinitionOptions, "image">;
+        container?: Omit<ContainerDefinitionOptions, "image"> & {
+            image?: ContainerDefinitionOptions["image"];
+        };
         /**
          * Runs codebuild job in the specified VPC. Note this will only work once deployed.
          *
@@ -300,8 +366,9 @@ export interface ServiceProps {
     };
 }
 type ServiceNormalizedProps = ServiceProps & {
-    path: Exclude<ServiceProps["path"], undefined>;
+    architecture: Exclude<ServiceProps["architecture"], undefined>;
     cpu: Exclude<ServiceProps["cpu"], undefined>;
+    path: Exclude<ServiceProps["path"], undefined>;
     memory: Exclude<ServiceProps["memory"], undefined>;
     port: Exclude<ServiceProps["port"], undefined>;
     logRetention: Exclude<ServiceProps["logRetention"], undefined>;

package/constructs/Service.js

@@ -19,7 +19,7 @@ import { attachPermissionsToRole } from "./util/permission.js";
 import { bindEnvironment, bindPermissions, getParameterPath, getReferencedSecrets, } from "./util/functionBinding.js";
 import { useProject } from "../project.js";
 import { Vpc, } from "aws-cdk-lib/aws-ec2";
-import { AwsLogDriver, Cluster, FargateTaskDefinition, ContainerImage, FargateService, } from "aws-cdk-lib/aws-ecs";
+import { AwsLogDriver, Cluster, ContainerImage, CpuArchitecture, FargateService, FargateTaskDefinition, } from "aws-cdk-lib/aws-ecs";
 import { LogGroup, LogRetention, RetentionDays } from "aws-cdk-lib/aws-logs";
 import { Platform } from "aws-cdk-lib/aws-ecr-assets";
 import { ApplicationLoadBalancer, } from "aws-cdk-lib/aws-elasticloadbalancingv2";
@@ -153,6 +153,7 @@ export class Service extends Construct {
         this.id = id;
         this.props = {
             path: ".",
+            architecture: props?.architecture || "x86_64",
             cpu: props?.cpu || "0.25 vCPU",
             memory: props?.memory || "0.5 GB",
             port: props?.port || 3000,
@@ -188,16 +189,19 @@ export class Service extends Construct {
         this.attachPermissionsForService(props?.permissions || []);
         Object.entries(props?.environment || {}).map(([key, value]) => this.addEnvironmentForService(key, value));
         useDeferredTasks().add(async () => {
-            if (!app.isRunningSSTTest()) {
+            if (!app.isRunningSSTTest() && !props?.cdk?.container?.image) {
                 Colors.line(`➜  Building the container image for the "${this.node.id}" service...`);
                 // Build app
                 let dockerfile;
+                // case: custom Dockerfile provided
                 if (this.props.file) {
                     dockerfile = this.props.file;
                 }
+                // case: default Dockerfile found
                 else if (await existsAsync(path.join(this.props.path, "Dockerfile"))) {
                     dockerfile = "Dockerfile";
                 }
+                // case: nixpack
                 else {
                     await this.createNixpacksBuilder();
                     dockerfile = await this.runNixpacksBuild();
@@ -384,7 +388,7 @@ export class Service extends Construct {
             }));
     }
     createService(vpc) {
-        const { cpu, memory, port, logRetention, cdk } = this.props;
+        const { architecture, cpu, memory, port, logRetention, cdk } = this.props;
         const app = this.node.root;
         const clusterName = app.logicalPrefixedName(this.node.id);
         const logGroup = new LogRetention(this, "LogRetention", {
@@ -402,6 +406,11 @@ export class Service extends Construct {
             // @ts-ignore
             memoryLimitMiB: supportedMemories[cpu][memory],
             cpu: supportedCpus[cpu],
+            runtimePlatform: {
+                cpuArchitecture: architecture === "arm64"
+                    ? CpuArchitecture.ARM64
+                    : CpuArchitecture.X86_64,
+            },
         });
         const container = taskDefinition.addContainer("Container", {
             logging: new AwsLogDriver({
@@ -415,11 +424,14 @@ export class Service extends Construct {
                 SST_SSM_PREFIX: useProject().config.ssmPrefix,
             },
             ...cdk?.container,
-            image: { bind: () => ({ imageName: "placeholder" }) },
+            image: cdk?.container?.image ?? {
+                bind: () => ({ imageName: "placeholder" }),
+            },
         });
         const service = new FargateService(this, "Service", {
             cluster,
             taskDefinition,
+            ...cdk?.fargateService,
         });
         return { cluster, taskDefinition, container, service };
     }
@@ -427,6 +439,8 @@ export class Service extends Construct {
         const { cdk } = this.props;
         // Do not create load balancer if disabled
         if (cdk?.applicationLoadBalancer === false) {
+            if (cdk?.applicationLoadBalancerTargetGroup)
+                throw new VisibleError(`In the "${this.node.id}" Service, the "cdk.applicationLoadBalancerTargetGroup" cannot be applied if the Application Load Balancer is diabled.`);
             return {};
         }
         const alb = new ApplicationLoadBalancer(this, "LoadBalancer", {
@@ -437,6 +451,7 @@ export class Service extends Construct {
         const target = listener.addTargets("TargetGroup", {
             port: 80,
             targets: [service],
+            ...cdk?.applicationLoadBalancerTargetGroup,
         });
         return { alb, target };
     }
@@ -592,13 +607,16 @@ export class Service extends Construct {
         return ".nixpacks/Dockerfile";
     }
     async runDockerBuild(dockerfile) {
+        const { path: servicePath, architecture, build } = this.props;
+        const platform = architecture === "arm64" ? "linux/arm64" : "linux/amd64";
         try {
             await execAsync([
                 "docker",
                 "build",
                 `-t sst-build:service-${this.node.id}`,
-                "--platform=linux/amd64",
-                `-f ${path.join(this.props.path, dockerfile)}`,
+                `--platform ${platform}`,
+                `-f ${path.join(servicePath, dockerfile)}`,
+                ...Object.entries(build?.buildArgs || {}).map(([k, v]) => `--build-arg ${k}=${v}`),
                 this.props.path,
             ].join(" "), {
                 env: {
@@ -612,9 +630,11 @@ export class Service extends Construct {
         }
     }
     updateContainerImage(dockerfile, taskDefinition, container) {
-        const image = ContainerImage.fromAsset(this.props.path, {
-            platform: Platform.LINUX_AMD64,
+        const { path: servicePath, architecture, build } = this.props;
+        const image = ContainerImage.fromAsset(servicePath, {
+            platform: architecture === "arm64" ? Platform.LINUX_ARM64 : Platform.LINUX_AMD64,
             file: dockerfile,
+            buildArgs: build?.buildArgs,
             exclude: [".sst"],
             ignoreMode: IgnoreMode.GLOB,
         });

package/constructs/SsrSite.d.ts

@@ -19,6 +19,7 @@ export type SsrBuildConfig = {
     clientBuildOutputDir: string;
     clientBuildVersionedSubDir: string;
     clientBuildS3KeyPrefix?: string;
+    clientCFFunctionInjection?: string;
     prerenderedBuildOutputDir?: string;
     prerenderedBuildS3KeyPrefix?: string;
 };
@@ -284,7 +285,10 @@ export declare abstract class SsrSite extends Construct implements SSTConstruct
     private serverLambdaForDev?;
     private serverUrlSigningFunction?;
     protected bucket: Bucket;
-    private cfFunction;
+    private serverCfFunction?;
+    private serverBehaviorCachePolicy?;
+    private serverBehaviorOriginRequestPolicy?;
+    private staticCfFunction?;
     private s3Origin;
     private distribution;
     constructor(scope: Construct, id: string, props?: SsrSiteProps);
@@ -347,19 +351,22 @@ export declare abstract class SsrSite extends Construct implements SSTConstruct
     private grantServerS3Permissions;
     private grantServerCloudFrontPermissions;
     private createCloudFrontS3Origin;
-    private createCloudFrontFunction;
     protected createCloudFrontDistributionForRegional(): Distribution;
     protected createCloudFrontDistributionForEdge(): Distribution;
-    protected buildDefaultBehaviorForRegional(cachePolicy: ICachePolicy): BehaviorOptions;
-    protected useServerUrlSigningFunction(): EdgeFunction;
-    protected buildDefaultBehaviorForEdge(cachePolicy: ICachePolicy): BehaviorOptions;
-    protected buildBehaviorFunctionAssociations(): {
+    protected buildDefaultBehaviorForRegional(): BehaviorOptions;
+    protected buildDefaultBehaviorForEdge(): BehaviorOptions;
+    protected addStaticFileBehaviors(): void;
+    protected useServerBehaviorFunctionAssociations(): {
         eventType: CfFunctionEventType;
         function: CfFunction;
     }[];
-    protected addStaticFileBehaviors(): void;
-    protected buildServerCachePolicy(allowedHeaders?: string[]): CachePolicy;
-    protected buildServerOriginRequestPolicy(): import("aws-cdk-lib/aws-cloudfront").IOriginRequestPolicy;
+    protected useStaticBehaviorFunctionAssociations(): {
+        eventType: CfFunctionEventType;
+        function: CfFunction;
+    }[];
+    protected useServerUrlSigningFunction(): EdgeFunction;
+    protected useServerBehaviorCachePolicy(allowedHeaders?: string[]): CachePolicy;
+    private useServerBehaviorOriginRequestPolicy;
     private getS3ContentReplaceValues;
     private validateSiteExists;
     private validateTimeout;

package/constructs/SsrSite.js

@@ -51,7 +51,10 @@ export class SsrSite extends Construct {
     serverLambdaForDev;
     serverUrlSigningFunction;
     bucket;
-    cfFunction;
+    serverCfFunction;
+    serverBehaviorCachePolicy;
+    serverBehaviorOriginRequestPolicy;
+    staticCfFunction;
     s3Origin;
     distribution;
     constructor(scope, id, props) {
@@ -75,8 +78,8 @@ export class SsrSite extends Construct {
         this.writeTypesFile();
         useSites().add(stack.stackName, id, this.constructor.name, this.props);
         if (this.doNotDeploy) {
-            // @ts-ignore
-            this.cfFunction = this.bucket = this.s3Origin = this.distribution = null;
+            // @ts-expect-error
+            this.bucket = this.s3Origin = this.distribution = null;
             this.serverLambdaForDev = this.createFunctionForDev();
             return;
         }
@@ -92,7 +95,6 @@ export class SsrSite extends Construct {
         this.grantServerS3Permissions();
         // Create CloudFront
         this.s3Origin = this.createCloudFrontS3Origin();
-        this.cfFunction = this.createCloudFrontFunction();
         this.distribution = this.props.edge
             ? this.createCloudFrontDistributionForEdge()
             : this.createCloudFrontDistributionForRegional();
@@ -486,21 +488,9 @@ export class SsrSite extends Construct {
             originPath: "/" + (this.buildConfig.clientBuildS3KeyPrefix ?? ""),
         });
     }
-    createCloudFrontFunction() {
-        return new CfFunction(this, "CloudFrontFunction", {
-            code: CfFunctionCode.fromInline(`
-function handler(event) {
-  var request = event.request;
-  request.headers["x-forwarded-host"] = request.headers.host;
-  ${this.buildConfig.serverCFFunctionInjection || ""}
-  return request;
-}`),
-        });
-    }
     createCloudFrontDistributionForRegional() {
         const { customDomain, cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
-        const cachePolicy = cdk?.serverCachePolicy ?? this.buildServerCachePolicy();
         return new Distribution(this, "CDN", {
             scopeOverride: this,
             customDomain,
@@ -511,7 +501,7 @@ function handler(event) {
                     // Override props.
                     ...cfDistributionProps,
                     // these values can NOT be overwritten by cfDistributionProps
-                    defaultBehavior: this.buildDefaultBehaviorForRegional(cachePolicy),
+                    defaultBehavior: this.buildDefaultBehaviorForRegional(),
                     additionalBehaviors: {
                         ...(cfDistributionProps.additionalBehaviors || {}),
                     },
@@ -522,7 +512,6 @@ function handler(event) {
     createCloudFrontDistributionForEdge() {
         const { customDomain, cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
-        const cachePolicy = cdk?.serverCachePolicy ?? this.buildServerCachePolicy();
         return new Distribution(this, "CDN", {
             scopeOverride: this,
             customDomain,
@@ -533,7 +522,7 @@ function handler(event) {
                     // Override props.
                     ...cfDistributionProps,
                     // these values can NOT be overwritten by cfDistributionProps
-                    defaultBehavior: this.buildDefaultBehaviorForEdge(cachePolicy),
+                    defaultBehavior: this.buildDefaultBehaviorForEdge(),
                     additionalBehaviors: {
                         ...(cfDistributionProps.additionalBehaviors || {}),
                     },
@@ -541,7 +530,7 @@ function handler(event) {
             },
         });
     }
-    buildDefaultBehaviorForRegional(cachePolicy) {
+    buildDefaultBehaviorForRegional() {
         const { timeout, regional, cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
         const fnUrl = this.serverLambdaForRegional.addFunctionUrl({
@@ -562,12 +551,12 @@ function handler(event) {
             allowedMethods: AllowedMethods.ALLOW_ALL,
             cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
-            cachePolicy,
+            cachePolicy: cdk?.serverCachePolicy ?? this.useServerBehaviorCachePolicy(),
             responseHeadersPolicy: cdk?.responseHeadersPolicy,
-            originRequestPolicy: this.buildServerOriginRequestPolicy(),
+            originRequestPolicy: this.useServerBehaviorOriginRequestPolicy(),
             ...(cfDistributionProps.defaultBehavior || {}),
             functionAssociations: [
-                ...this.buildBehaviorFunctionAssociations(),
+                ...this.useServerBehaviorFunctionAssociations(),
                 ...(cfDistributionProps.defaultBehavior?.functionAssociations || []),
             ],
             edgeLambdas: [
@@ -584,25 +573,7 @@ function handler(event) {
             ],
         };
     }
-    useServerUrlSigningFunction() {
-        this.serverUrlSigningFunction =
-            this.serverUrlSigningFunction ??
-                new EdgeFunction(this, "ServerUrlSigningFunction", {
-                    bundle: path.join(__dirname, "../support/signing-function"),
-                    runtime: "nodejs18.x",
-                    handler: "index.handler",
-                    timeout: 10,
-                    memorySize: 128,
-                    permissions: [
-                        new PolicyStatement({
-                            actions: ["lambda:InvokeFunctionUrl"],
-                            resources: [this.serverLambdaForRegional?.functionArn],
-                        }),
-                    ],
-                });
-        return this.serverUrlSigningFunction;
-    }
-    buildDefaultBehaviorForEdge(cachePolicy) {
+    buildDefaultBehaviorForEdge() {
         const { cdk } = this.props;
         const cfDistributionProps = cdk?.distribution || {};
         return {
@@ -611,12 +582,12 @@ function handler(event) {
             allowedMethods: AllowedMethods.ALLOW_ALL,
             cachedMethods: CachedMethods.CACHE_GET_HEAD_OPTIONS,
             compress: true,
-            cachePolicy,
+            cachePolicy: cdk?.serverCachePolicy ?? this.useServerBehaviorCachePolicy(),
             responseHeadersPolicy: cdk?.responseHeadersPolicy,
-            originRequestPolicy: this.buildServerOriginRequestPolicy(),
+            originRequestPolicy: this.useServerBehaviorOriginRequestPolicy(),
             ...(cfDistributionProps.defaultBehavior || {}),
             functionAssociations: [
-                ...this.buildBehaviorFunctionAssociations(),
+                ...this.useServerBehaviorFunctionAssociations(),
                 ...(cfDistributionProps.defaultBehavior?.functionAssociations || []),
             ],
             edgeLambdas: [
@@ -629,14 +600,6 @@ function handler(event) {
             ],
         };
     }
-    buildBehaviorFunctionAssociations() {
-        return [
-            {
-                eventType: CfFunctionEventType.VIEWER_REQUEST,
-                function: this.cfFunction,
-            },
-        ];
-    }
     addStaticFileBehaviors() {
         const { cdk } = this.props;
         // Create a template for statics behaviours
@@ -650,27 +613,93 @@ function handler(event) {
                 compress: true,
                 cachePolicy: CachePolicy.CACHING_OPTIMIZED,
                 responseHeadersPolicy: cdk?.responseHeadersPolicy,
+                functionAssociations: [
+                    ...this.useStaticBehaviorFunctionAssociations(),
+                ],
             });
         }
     }
-    buildServerCachePolicy(allowedHeaders) {
-        return new CachePolicy(this, "ServerCache", {
-            queryStringBehavior: CacheQueryStringBehavior.all(),
-            headerBehavior: allowedHeaders && allowedHeaders.length > 0
-                ? CacheHeaderBehavior.allowList(...allowedHeaders)
-                : CacheHeaderBehavior.none(),
-            cookieBehavior: CacheCookieBehavior.none(),
-            defaultTtl: CdkDuration.days(0),
-            maxTtl: CdkDuration.days(365),
-            minTtl: CdkDuration.days(0),
-            enableAcceptEncodingBrotli: true,
-            enableAcceptEncodingGzip: true,
-            comment: "SST server response cache policy",
-        });
+    useServerBehaviorFunctionAssociations() {
+        this.serverCfFunction =
+            this.serverCfFunction ??
+                new CfFunction(this, "CloudFrontFunction", {
+                    code: CfFunctionCode.fromInline(`
+function handler(event) {
+  var request = event.request;
+  request.headers["x-forwarded-host"] = request.headers.host;
+  ${this.buildConfig.serverCFFunctionInjection || ""}
+  return request;
+}`),
+                });
+        return [
+            {
+                eventType: CfFunctionEventType.VIEWER_REQUEST,
+                function: this.serverCfFunction,
+            },
+        ];
+    }
+    useStaticBehaviorFunctionAssociations() {
+        if (!this.buildConfig.clientCFFunctionInjection)
+            return [];
+        this.staticCfFunction =
+            this.staticCfFunction ??
+                new CfFunction(this, "CloudFrontFunctionForStaticBehavior", {
+                    code: CfFunctionCode.fromInline(`
+function handler(event) {
+  var request = event.request;
+  ${this.buildConfig.clientCFFunctionInjection || ""}
+  return request;
+}`),
+                });
+        return [
+            {
+                eventType: CfFunctionEventType.VIEWER_REQUEST,
+                function: this.staticCfFunction,
+            },
+        ];
+    }
+    useServerUrlSigningFunction() {
+        this.serverUrlSigningFunction =
+            this.serverUrlSigningFunction ??
+                new EdgeFunction(this, "ServerUrlSigningFunction", {
+                    bundle: path.join(__dirname, "../support/signing-function"),
+                    runtime: "nodejs18.x",
+                    handler: "index.handler",
+                    timeout: 10,
+                    memorySize: 128,
+                    permissions: [
+                        new PolicyStatement({
+                            actions: ["lambda:InvokeFunctionUrl"],
+                            resources: [this.serverLambdaForRegional?.functionArn],
+                        }),
+                    ],
+                });
+        return this.serverUrlSigningFunction;
+    }
+    useServerBehaviorCachePolicy(allowedHeaders) {
+        this.serverBehaviorCachePolicy =
+            this.serverBehaviorCachePolicy ??
+                new CachePolicy(this, "ServerCache", {
+                    queryStringBehavior: CacheQueryStringBehavior.all(),
+                    headerBehavior: allowedHeaders && allowedHeaders.length > 0
+                        ? CacheHeaderBehavior.allowList(...allowedHeaders)
+                        : CacheHeaderBehavior.none(),
+                    cookieBehavior: CacheCookieBehavior.none(),
+                    defaultTtl: CdkDuration.days(0),
+                    maxTtl: CdkDuration.days(365),
+                    minTtl: CdkDuration.days(0),
+                    enableAcceptEncodingBrotli: true,
+                    enableAcceptEncodingGzip: true,
+                    comment: "SST server response cache policy",
+                });
+        return this.serverBehaviorCachePolicy;
     }
-    buildServerOriginRequestPolicy() {
+    useServerBehaviorOriginRequestPolicy() {
         // CloudFront's Managed-AllViewerExceptHostHeader policy
-        return OriginRequestPolicy.fromOriginRequestPolicyId(this, "ServerOriginRequestPolicy", "b689b0a8-53d0-40ab-baf2-68738e2966ac");
+        this.serverBehaviorOriginRequestPolicy =
+            this.serverBehaviorOriginRequestPolicy ??
+                OriginRequestPolicy.fromOriginRequestPolicyId(this, "ServerOriginRequestPolicy", "b689b0a8-53d0-40ab-baf2-68738e2966ac");
+        return this.serverBehaviorOriginRequestPolicy;
     }
     /////////////////////
     // Helper Functions

package/package.json

@@ -1,7 +1,7 @@
 {
   "sideEffects": false,
   "name": "sst",
-  "version": "2.24.22",
+  "version": "2.24.24",
   "bin": {
     "sst": "cli/sst.js"
   },

package/runtime/handlers/container.js

@@ -58,6 +58,7 @@ export const useContainerHandler = Context.memo(async () => {
                         ...(input.props.container?.file
                             ? [`-f ${input.props.container.file}`]
                             : []),
+                        ...Object.entries(input.props.container?.buildArgs || {}).map(([k, v]) => `--build-arg ${k}=${v}`),
                         `.`,
                     ].join(" "), {
                         cwd: project,
@@ -84,6 +85,7 @@ export const useContainerHandler = Context.memo(async () => {
                         ...(input.props.container?.file
                             ? [`-f ${input.props.container.file}`]
                             : []),
+                        ...Object.entries(input.props.container?.buildArgs || {}).map(([k, v]) => `--build-arg ${k}=${v}`),
                         `--platform ${platform}`,
                         `.`,
                     ].join(" "), {

package/runtime/handlers/java.js

@@ -68,26 +68,22 @@ export const useJavaHandler = Context.memo(async () => {
             const buildTask = input.props.java?.buildTask || "build";
             const outputDir = input.props.java?.buildOutputDir || "distributions";
             sources.set(input.functionID, srcPath);
-            async function build() {
-                // build
-                await execAsync(`${buildBinary} ${buildTask} -Dorg.gradle.logging.level=${process.env.DEBUG ? "debug" : "lifecycle"}`, {
-                    cwd: srcPath,
-                });
-                // unzip
-                const buildOutput = path.join(srcPath, "build", outputDir);
-                const zip = (await fs.readdir(buildOutput)).find((f) => f.endsWith(".zip"));
-                await new Promise((resolve, reject) => {
-                    const zipper = new AdmZip(path.join(buildOutput, zip));
-                    zipper.extractAllToAsync(input.out, false, false, (err) => err ? reject(err) : resolve(undefined));
-                });
-            }
             try {
-                // Run gradle build once per directory. Otherwise they'll interfere
+                // Build
+                // Note: run gradle build once per directory. Otherwise they'll interfere
                 // with one another
-                const buildPromise = runningBuilds.get(buildBinary) ?? build();
+                const buildPromise = runningBuilds.get(buildBinary) ??
+                    execAsync(`${buildBinary} ${buildTask} -Dorg.gradle.logging.level=${process.env.DEBUG ? "debug" : "lifecycle"}`, {
+                        cwd: srcPath,
+                    });
                 runningBuilds.set(buildBinary, buildPromise);
                 await buildPromise;
                 runningBuilds.delete(buildBinary);
+                // unzip
+                const buildOutput = path.join(srcPath, "build", outputDir);
+                const zip = (await fs.readdir(buildOutput)).find((f) => f.endsWith(".zip"));
+                const zipper = new AdmZip(path.join(buildOutput, zip));
+                zipper.extractAllTo(input.out, false, false);
                 return {
                     type: "success",
                     handler: input.props.handler,