From eaaa4f1ad930636ba4c28bd7ec602703747be55d Mon Sep 17 00:00:00 2001
From: emi <emerytgriffith@gmail.com>
Date: Fri, 24 Jul 2026 03:47:39 +0000
Subject: [PATCH] Fix lake extension bake user; disable the daemon healthcheck
 in the stack (#30)

---
 backend/Dockerfile                       | 7 ++++---
 infra/deploy/stack/thermograph-stack.yml | 7 +++++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/backend/Dockerfile b/backend/Dockerfile
index f422d16..5641a0c 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -33,9 +33,6 @@ RUN apt-get update \
 # Install deps first so this layer caches across code-only changes.
 COPY requirements.txt /tmp/requirements.txt
 RUN pip install --no-cache-dir -r /tmp/requirements.txt
-# Bake DuckDB's httpfs extension so the lake role's S3 reads need no runtime
-# extension download (tasks may roll while egress is degraded).
-RUN python -c "import duckdb; duckdb.connect().execute('INSTALL httpfs')"
 
 # The daemon binary lands before the app tree: it changes far less often than
 # the Python code, so this layer usually cache-hits and only the COPY below
@@ -56,6 +53,10 @@ RUN useradd --system --create-home --uid 10001 thermograph \
     && chown -R thermograph:thermograph /app /state
 
 USER thermograph
+# Bake DuckDB's httpfs extension AS THE RUNTIME USER — extensions install to
+# the invoking user's ~/.duckdb, and a root-time bake leaves uid 10001 unable
+# to LOAD it (seen live: prod lake /query 500'd on exactly this).
+RUN python -c "import duckdb; duckdb.connect().execute('INSTALL httpfs')"
 WORKDIR /app
 
 ENV PORT=8137 \
diff --git a/infra/deploy/stack/thermograph-stack.yml b/infra/deploy/stack/thermograph-stack.yml
index 8bbc3c2..12aef0b 100644
--- a/infra/deploy/stack/thermograph-stack.yml
+++ b/infra/deploy/stack/thermograph-stack.yml
@@ -208,6 +208,13 @@ services:
     # endpoints on a timer), so the daemon holds no state and logs to stdout.
     volumes:
       - /etc/thermograph/stack.env:/host/thermograph.env:ro
+    # The image HEALTHCHECK curls /healthz on ${PORT} — right for the app,
+    # meaningless for the daemon (it serves nothing). Without this override
+    # Swarm marks the task unhealthy and restarts it forever (seen live on the
+    # first prod stack deploy: gateway up, killed ~100s later, 0/1 loop). The
+    # compose file already disables it; the stack file must too.
+    healthcheck:
+      disable: true
     networks:
       - internal
     deploy: