fix(#54): point OMNIBIOAI_HOST_APP_PREFIX/PROXY_ALLOWED_BIND_PREFIXES at the real omnibioai-workbench checkout - #65
Merged
Conversation
… at the real omnibioai-workbench checkout
workflow_runner (omnibioai-workbench) spawns a sibling Nextflow/Cromwell
container and rewrites its /app/... volume sources back to real host
paths via OMNIBIOAI_HOST_APP_PREFIX + docker-shim.sh, so the outer
Docker daemon (via docker-socket-proxy) can bind them. This env var was
set to ${WORKSPACE_HOST}, the whole machine directory (used elsewhere
for an unrelated broad /workspace mount) -- not the repo /app is
actually built from (this file's own `context: ${MACHINE_DIR}/
omnibioai-workbench` for the workbench/celery-worker services).
Confirmed live: every past bind-mount attempt through this wrong value
(and workflow_runner's own equally-stale Python-side fallback default)
resolved against ${MACHINE_DIR}/omnibioai -- a directory that has never
held a real checkout -- and Docker auto-created it as empty, root-owned
debris on the host rather than failing loudly.
Changes:
- OMNIBIOAI_HOST_APP_PREFIX: ${WORKSPACE_HOST} -> ${MACHINE_DIR}/omnibioai-workbench
(workbench + celery-worker services, all 3 compose files)
- PROXY_ALLOWED_BIND_PREFIXES: ${MACHINE_DIR}/omnibioai ->
${MACHINE_DIR}/omnibioai-workbench, so the corrected bind source is
still proxy-allowed
- Flagged (not fixed, separate pre-existing gap, unrelated repo):
TES's own local.py _find_repo_root() returns the PARENT containing an
omnibioai/ subdir, not the subdir itself -- so its real repo_root bind
source is bare ${MACHINE_DIR}, which was never covered by the old
${MACHINE_DIR}/omnibioai entry either. Documented inline, not changed
here.
WORKSPACE_HOST itself and .env are untouched -- other services
(toolserver etc.) still rely on WORKSPACE_HOST's current broad value for
their own /workspace mount, unrelated to this fix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9s2QraSk9rkMgB3Msiz2S
Pre-merge review caught this: comments claimed OMNIBIOAI_HOST_APP_PREFIX/
workflow_runner's own stale fallback was "the source of" the wrecked,
empty ${MACHINE_DIR}/omnibioai directory. Checked further and that's not
supported -- the directory's own mtimes and the real `tes` container's
start time both predate every run this fix's live-verification did,
while `tes` itself has its own unrelated, long-running
`${MACHINE_DIR}/omnibioai:${MACHINE_DIR}/omnibioai:rw` bind in this same
file (Docker auto-creates a missing bind source as an empty directory
the first time a container using it starts) -- a far more likely actual
origin. Corrected the comments to say so instead of overclaiming
workflow_runner as the cause; the fix itself (OMNIBIOAI_HOST_APP_PREFIX/
PROXY_ALLOWED_BIND_PREFIXES now pointing at the real omnibioai-workbench
checkout) is unaffected either way. Matching correction made in the
companion omnibioai-workbench PR.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V9s2QraSk9rkMgB3Msiz2S
man4ish
added a commit
that referenced
this pull request
Aug 31, 2026
Correct stale Admin Console claims against current merged omnibioai-control-center main (PRs #65-#71): - Admin Console is live-tested at admin.omnibioai.org (authenticated E2E 8/8), not deployment-dependent. - Security Audit Explorer is merged and live-certified for its exercised paths (deep link, hard refresh, sidebar, history, filters/details, safe metadata, read-only) -- no longer 'not yet a completed UI'. - Document /workflows as the committed deep-link route; /workflow-operations is explicitly not a separate committed route. - Preserve the Audit Logs vs. Audit Explorer distinction (Auth identity ledger vs. Security Audit's safe durable audit-event contract). - Add a high-level Admin Console -> Control Center -> Security Audit safe API -> durable audit_events architecture diagram, linking to the authoritative Control Center Admin Console guide instead of duplicating it. - Add a concise SAT-1..SAT-4 status summary without claiming ecosystem-wide completeness. - Keep the existing Integration Health / WORKBENCH_PLUGIN_REGISTRY_PATH documentation (accurate, from the prior unpushed commit) and clarify the inventory is derived dynamically, not hard-coded. README.md only; no product/config changes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W1o9a9tktwmpSjnYraVGNo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
workflow_runner (omnibioai-workbench,
plugins/workflow_runner/views.py::_run_in_docker_runner) spawns a sibling Nextflow/Cromwell container and rewrites its/app/...volume sources back to real host paths viaOMNIBIOAI_HOST_APP_PREFIX+docker-shim.sh, so the outer Docker daemon (via docker-socket-proxy) can bind them.OMNIBIOAI_HOST_APP_PREFIXwas set to${WORKSPACE_HOST}-- the whole machine directory (also used elsewhere for an unrelated, intentionally-broad/workspacemount on other services) -- not the repo/appis actually built from (this file's owncontext: ${MACHINE_DIR}/omnibioai-workbenchfor the workbench/celery-worker services).Confirmed live: every past bind-mount attempt through this wrong value (and workflow_runner's own equally-stale Python-side fallback default, fixed in the companion omnibioai-workbench PR) resolved against
${MACHINE_DIR}/omnibioai-- a directory that has never held a real checkout -- and Docker silently auto-created it as empty, root-owned debris on the host instead of failing loudly.Fix
OMNIBIOAI_HOST_APP_PREFIX:${WORKSPACE_HOST}→${MACHINE_DIR}/omnibioai-workbench(workbench + celery-worker services, all 3 compose files).PROXY_ALLOWED_BIND_PREFIXES:${MACHINE_DIR}/omnibioai→${MACHINE_DIR}/omnibioai-workbench, so the corrected bind source is still proxy-allowed.local.py::_find_repo_root()returns the parent containing anomnibioai/subdir, not the subdir itself -- so its realrepo_rootbind source is bare${MACHINE_DIR}, which was never covered by the old${MACHINE_DIR}/omnibioaientry either, before or after this rename.WORKSPACE_HOSTitself and.envare untouched -- other services (toolserver etc.) still rely onWORKSPACE_HOST's current broad value for their own unrelated/workspacemount.Companion PR
omnibioai-workbench: OmniBioAI/omnibioai-workbench#461 -- fixes the matching Python-side stale fallback defaults + the object-registry path-resolution root blocker this same live-verification uncovered, and does the full real end-to-end verification (real bundle registered, submitted through the real API, ran to completion including a real nested Docker task through this proxy chain).
Verification
docker compose -f docker-compose.yml config(all 3 files parse; interpolation confirmed to resolveOMNIBIOAI_HOST_APP_PREFIXto the real, populated/home/manish/Desktop/machine/omnibioai-workbench, now insidePROXY_ALLOWED_BIND_PREFIXES).docker-socket-proxy+ rebuilt/redeployedworkbenchwith this config; a real Nextflow workflow run (including a nested Docker task via docker-socket-proxy) completed successfully end-to-end for the first time -- see companion PR #461 for the full E2E verification detail.Not merged -- open for review per standing instruction.
🤖 Generated with Claude Code