Implement netcat listener for open port scanning on Render#1607
Implement netcat listener for open port scanning on Render#1607lightwalker-eth merged 4 commits intomainfrom
Conversation
Added netcat listener for incoming connections and cleanup function on exit.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 3 Skipped Deployments
|
|
📝 WalkthroughWalkthroughAdds a netcat-based background listener to container init: the Dockerfile installs Changes
Sequence DiagramsequenceDiagram
participant Container as Container Init
participant Netcat as Netcat Listener
participant DB as Database Operations
participant Server as Application Server
Container->>Netcat: Start background listener on service port
Note over Netcat: Holds port while DB download/validation run\n(no HTTP responses)
Container->>DB: Download and validate database
DB-->>Container: Database ready
Container->>Netcat: Call cleanup_nc() (via EXIT trap or explicit)
Netcat->>Netcat: Terminate process (release port)
Netcat-->>Container: Port released
Container->>Container: Short delay to ensure port free
Container->>Server: Start application server
Server->>Server: Bind to service port
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR attempts to address healthcheck issues during the long startup period of the ENSRainbow service by adding a netcat listener that occupies the application port while the database is being downloaded and validated. The ensrainbow service has a 20-minute start period because it downloads and validates a large database before starting the actual server.
Changes:
- Added netcat-openbsd package to the Docker image
- Started a netcat listener on the application port during startup to respond to health checks
- Added cleanup logic to kill the netcat listener before starting the actual ENSRainbow server
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| apps/ensrainbow/Dockerfile | Added netcat-openbsd package installation to support the netcat listener |
| apps/ensrainbow/scripts/entrypoint.sh | Added netcat listener startup, cleanup function, and pre-server cleanup logic |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
🚀 Preview Packages -
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@apps/ensrainbow/Dockerfile`:
- Line 5: The RUN instruction installing packages in the Dockerfile ("RUN
apt-get update && apt-get install -y wget tar netcat-openbsd && rm -rf
/var/lib/apt/lists/*") should add --no-install-recommends to apt-get install to
avoid pulling recommended packages and reduce image size; update that command to
use apt-get install -y --no-install-recommends and, if deterministic builds are
required, pin package versions (e.g., package=version) or add an APT sources
snapshot so the RUN line (the installation step) produces reproducible, smaller
images.
In `@apps/ensrainbow/scripts/entrypoint.sh`:
- Around line 144-149: After calling cleanup_nc, immediately verify that the
netcat process was actually terminated (e.g., check NC_PID/process existence
with kill -0 or ps) before clearing NC_PID and removing the EXIT trap; if the
process still exists or the PID was reused, log an error and exit non-zero to
fail fast rather than proceeding to start the server. Ensure the check
references cleanup_nc, NC_PID and the trap - EXIT sequence so the script only
clears NC_PID and removes the trap after confirming netcat is no longer running.
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
djstrong
changed the title
Greptile OverviewGreptile SummaryThis PR keeps Render health checks from failing during ENSRainbow’s long initialization by starting a background Key integration point: the listener runs only during the DB download/validate phase and is intended to be torn down immediately before Confidence Score: 3/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant Orchestrator as Render/Orchestrator
participant Entrypoint as entrypoint.sh
participant NC as nc listener
participant Downloader as download/validate
participant Server as pnpm serve
Orchestrator->>Entrypoint: Start container (PORT set)
Entrypoint->>NC: nc -lk -p $PORT (background)
Orchestrator->>NC: Health checks / connections
Entrypoint->>Downloader: Download + extract DB (if needed)
Entrypoint->>Downloader: pnpm validate:lite
Entrypoint->>NC: cleanup_nc() / kill $NC_PID
Entrypoint->>Server: exec pnpm run serve --port $PORT
Orchestrator->>Server: Health checks / traffic
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
terraform/modules/ensadmin/main.tf (1)
1-52:⚠️ Potential issue | 🟡 MinorRun
terraform fmtto fix CI failure.The CI pipeline reports formatting differences in this file; please reformat and re-run the check.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@terraform/modules/ensadmin/main.tf`:
- Around line 42-45: The joined FQDN list built for
NEXT_PUBLIC_SERVER_CONNECTION_LIBRARY uses values(local.api_fqdns) which is
unordered; change the iteration to use a deterministic ordering such as sorting
keys(local.api_fqdns) and then mapping those keys to their FQDN values so the
join(...) produces a stable, repeatable string (update the expression that
constructs NEXT_PUBLIC_SERVER_CONNECTION_LIBRARY to iterate over sorted keys and
build "https://${fqdn}" from the corresponding values).
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
lightwalker-eth
left a comment
lightwalker-eth
left a comment
There was a problem hiding this comment.
@djstrong Shared a few small comments. There's also a number of comments from AI agents that look to have good feedback. Appreciate if you can review all AI agent feedback and resolve as you think is best. Thanks
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@apps/ensrainbow/scripts/entrypoint.sh`:
- Around line 152-157: The fixed 2-second sleep in the entrypoint is unnecessary
and adds startup latency; remove or shorten it and instead ensure the port is
free after cleanup_nc returns (which already does kill + wait). Update the block
around the exec pnpm run serve line to either remove sleep entirely or replace
sleep 2 with sleep 0.5, or better implement a short fail-fast guard that polls
the port (loop checking that nc/netstat/lsof shows no listener) and only
proceeds when the port is confirmed free; refer to the existing cleanup_nc
helper to verify it has completed before starting the server and use that helper
as the trigger to start exec pnpm run serve --port "${PORT}" --data-dir
"${DB_SUBDIR_PATH}".
- Around line 39-55: Move the cleanup function definition (cleanup_nc) and the
trap registration (trap cleanup_nc EXIT) to before the nc invocation so the
listener cannot be orphaned if the script exits; start nc using the portable
positional form nc -lk "${PORT}" and background it into NC_PID, then immediately
verify the listener started (e.g., short sleep then ensure NC_PID is alive with
kill -0 "$NC_PID" and/or confirm the port is bound) and fail early if
verification fails so set -e surfaces bind errors.
lightwalker-eth
left a comment
lightwalker-eth
left a comment
There was a problem hiding this comment.
@djstrong Really appreciate your updates here. Looks good 👍
Lite PR
Summary
netcat-openbsdpackage to Dockerfile dependenciesWhy
During container initialization, ENSRainbow can take a long time to download and validate the database (up to 20 minutes). Without a listener on the port during this phase, Render health checks fail and orchestration systems may mark the container as unhealthy or restart it prematurely. The netcat listener keeps the port open and accepts connections during initialization, then is cleanly terminated when the actual server is ready to start.
Testing
Notes for Reviewer (Optional)
Pre-Review Checklist (Blocking)