From 25c93984ad45edf9b9a484f8089a10bb670291aa Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Fri, 11 Sep 2026 16:02:47 -0700
Subject: [PATCH] fix(build): build the loki/alloy/comfyui images in docker
 format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The healthcheck added to the loki image was discarded by the build:
'HEALTHCHECK is not supported for OCI image format and will be ignored'.
podman builds OCI by default, and OCI has no HEALTHCHECK field, so the
container came back with no health at all — worse than the failing check it
replaced, because nothing reports the loss.

The build now passes --format docker, and the seam pins it so a future edit
cannot quietly reintroduce an image with no health field.
---
 dankclaw/loki/Containerfile      | 7 ++++++-
 scripts/deploy-remote.sh         | 7 ++++++-
 tests/observability_quadlet.bats | 7 +++++++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/dankclaw/loki/Containerfile b/dankclaw/loki/Containerfile
index b14626c..a0ef4b7 100644
--- a/dankclaw/loki/Containerfile
+++ b/dankclaw/loki/Containerfile
@@ -10,7 +10,12 @@
 # container report its own health instead of looking merely "Up" while wedged.
 #
 # Build on dankclaw:
-#   podman build -t franksdank/loki:latest -f dankclaw/loki/Containerfile .
+#   podman build --format docker -t franksdank/loki:latest \
+#       -f dankclaw/loki/Containerfile .
+#
+# --format docker is required: podman's default OCI image format has no
+# HEALTHCHECK field, so a default-format build warns and silently discards the
+# one below, leaving a container that reports no health at all.
 
 FROM docker.io/library/alpine:latest AS tools
 # busybox-static is statically linked: the target images have no dynamic
diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh
index 7a67348..4fff48c 100755
--- a/scripts/deploy-remote.sh
+++ b/scripts/deploy-remote.sh
@@ -456,7 +456,12 @@ build_compose_image() {
     cfhash="$(sha256sum "$containerfile" | cut -d' ' -f1)"
     oldhash="$(podman image inspect "$image" --format '{{index .Config.Labels "cfhash"}}' 2>/dev/null || echo none)"
     if [[ "$oldhash" != "$cfhash" ]]; then
-        podman build --no-cache --label "cfhash=$cfhash" -t "$image" -f "$containerfile" .
+        # --format docker is required, not cosmetic: podman defaults to the OCI
+        # image format, which has no HEALTHCHECK field at all, so a build in
+        # the default format silently drops the loki image's healthcheck and
+        # the container then reports no health instead of failing loudly.
+        podman build --format docker --no-cache --label "cfhash=$cfhash" \
+            -t "$image" -f "$containerfile" .
     fi
 }
 
diff --git a/tests/observability_quadlet.bats b/tests/observability_quadlet.bats
index aeb0a5f..38d209b 100755
--- a/tests/observability_quadlet.bats
+++ b/tests/observability_quadlet.bats
@@ -161,6 +161,13 @@ service_section() {
     grep -q 'COPY --from=tools /bin/busybox.static /usr/local/bin/busybox' "$cf"
 }
 
+@test "the loki/alloy/comfyui build uses the docker image format" {
+    # Without --format docker the loki healthcheck is silently discarded (OCI
+    # has no HEALTHCHECK field) and the container stops reporting health.
+    grep -q -- '--format docker' "$REMOTE_DEPLOY"
+    grep -q 'podman build --format docker --no-cache' "$REMOTE_DEPLOY"
+}
+
 @test "grafana gets its OAuth client secret without getting a whole env file" {
     # systemd expands ${GRAFANA_OAUTH_CLIENT_SECRET} for the [Container]
     # Environment= line from the [Service] EnvironmentFile, which keeps the