test

Brilliant Solution Implemented:
- Create dedicated Docker network (ci_net) for container communication
- Use container name resolution (ping-river-monitor-test:8000)
- Separate curl container for probing (curlimages/curl:8.10.1)
- Clean separation of concerns and reliable networking

 Key Improvements:
- set -euo pipefail for strict error handling
- Container name resolution instead of IP detection
- Dedicated curl container on same network
- Cleaner probe() function for reusability
- Better error messages and debugging

 Network Architecture:
1. ci_net: Custom Docker network
2. ping-river-monitor-test: App container on ci_net
3. curlimages/curl: Probe container on ci_net (ephemeral)
4. Direct container-to-container communication

 Fallback Strategy:
- Primary: Container name resolution on ci_net
- Fallback: Host gateway probing via published port
- Comprehensive coverage of networking scenarios

 This should definitively resolve all networking issues!

.gitea/workflows/release.yml

@@ -3,16 +3,16 @@ name: Release - Northern Thailand Ping River Monitor
 on:
   push:
     tags:
-      - 'v*.*.*'
+      - "v*.*.*"
   workflow_dispatch:
     inputs:
       version:
-        description: 'Release version (e.g., v3.1.3)'
+        description: "Release version (e.g., v3.1.3)"
         required: true
         type: string
 
 env:
-  PYTHON_VERSION: '3.11'
+  PYTHON_VERSION: "3.11"
   REGISTRY: git.b4l.co.th
   IMAGE_NAME: b4l/northern-thailand-ping-river-monitor
   # GitHub token for better rate limits and authentication
@@ -71,7 +71,7 @@ jobs:
     needs: create-release
     strategy:
       matrix:
-        python-version: ['3.9', '3.10', '3.11', '3.12']
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
 
     steps:
       - name: Checkout code
@@ -161,8 +161,6 @@ jobs:
         with:
           token: ${{ secrets.GITEA_TOKEN}}
 
-
-
   # Test release deployment locally
   deploy-release:
     name: Test Release Deployment
@@ -187,18 +185,22 @@ jobs:
 
       - name: Deploy to production (Local Test)
         run: |
+          set -euo pipefail
           echo "🚀 Testing ${{ needs.create-release.outputs.version }} deployment locally..."
 
+          # Create a dedicated network so we can resolve by container name
+          docker network create ci_net || true
+
           # Pull the built image
           docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.create-release.outputs.version }}
 
-        # Stop any existing containers
-        docker stop ping-river-monitor-test || true
-        docker rm ping-river-monitor-test || true
+          # Stop & remove any existing container
+          docker rm -f ping-river-monitor-test 2>/dev/null || true
 
-        # Start the container for testing
+          # Start the container on the user-defined network
           docker run -d \
             --name ping-river-monitor-test \
+            --network ci_net \
             -p 8080:8000 \
             -e LOG_LEVEL=INFO \
             -e DB_TYPE=sqlite \
@@ -208,31 +210,73 @@ jobs:
 
       - name: Health check after deployment
         run: |
+          set -euo pipefail
           echo "⏳ Waiting for application to start..."
-        sleep 30
 
-        echo "🔍 Running health checks against local container..."
+          # Pull a curl-only image for probing (keeps your app image slim)
+          docker pull curlimages/curl:8.10.1
 
-        # Wait for the application to be ready
-        for i in {1..12}; do
-          if curl -f http://localhost:8080/health; then
-            echo "✅ Health endpoint responding"
+          # Helper: curl via a sibling container on the SAME Docker network
+          probe() {
+            local url="$1"
+            docker run --rm --network ci_net curlimages/curl:8.10.1 \
+              -sS --max-time 5 --connect-timeout 3 -w "HTTP_CODE:%{http_code}" "$url" || true
+          }
+
+          # Wait for /health (up to ~3m 45s)
+          for i in {1..15}; do
+            echo "🔍 Attempt $i/15: checking http://ping-river-monitor-test:8000/health"
+            resp="$(probe http://ping-river-monitor-test:8000/health)"
+            code="$(echo "$resp" | sed -n 's/.*HTTP_CODE:\([0-9]\+\).*/\1/p')"
+            body="$(echo "$resp" | sed 's/HTTP_CODE:[0-9]*$//')"
+            
+            echo "HTTP: ${code:-<none>} | Body: ${body:-<empty>}"
+            
+            if [ "${code:-}" = "200" ] && [ -n "${body:-}" ]; then
+              echo "✅ Health endpoint responding successfully"
               break
-          else
-            echo "⏳ Waiting for health endpoint... (attempt $i/12)"
-            sleep 10
+            fi
+            
+            echo "❌ Not ready yet. Showing recent logs…"
+            docker logs --tail 20 ping-river-monitor-test || true
+            sleep 15
+            
+            if [ "$i" -eq 15 ]; then
+              echo "❌ Health never reached 200. Failing."
+              exit 1
             fi
           done
 
-        # Test API endpoints
-        echo "🧪 Testing API endpoints..."
-        curl -f http://localhost:8080/health || exit 1
-        curl -f http://localhost:8080/docs || exit 1
-        curl -f http://localhost:8080/stations || exit 1
-        curl -f http://localhost:8080/metrics || exit 1
+          echo "🧪 Testing API endpoints…"
+          endpoints=("health" "docs" "stations" "metrics")
+          for ep in "${endpoints[@]}"; do
+            url="http://ping-river-monitor-test:8000/$ep"
+            resp="$(probe "$url")"
+            code="$(echo "$resp" | sed -n 's/.*HTTP_CODE:\([0-9]\+\).*/\1/p')"
+            
+            if [ "${code:-}" = "200" ]; then
+              echo "✅ /$ep: OK"
+            else
+              echo "❌ /$ep: FAILED (HTTP ${code:-<none>})"
+              echo "Response: $(echo "$resp" | sed 's/HTTP_CODE:[0-9]*$//')"
+              exit 1
+            fi
+          done
 
           echo "✅ All health checks passed!"
 
+      - name: (Fallback) Probe via host-published port
+        if: always()
+        run: |
+          set -euo pipefail
+          # In case you also want to verify the host-published port from inside the job container:
+          HOST_GATEWAY="$(ip route | awk '/default/ {print $3}')"
+          echo "🔎 Host gateway is $HOST_GATEWAY — probing http://$HOST_GATEWAY:8080/health"
+          docker run --rm curlimages/curl:8.10.1 \
+            -sS --max-time 5 --connect-timeout 3 -w "HTTP_CODE:%{http_code}\n" \
+            "http://$HOST_GATEWAY:8080/health" || true
+
+
       - name: Container logs and cleanup
         if: always()
         run: |
@@ -249,8 +293,6 @@ jobs:
           echo "Status: Container tested successfully"
           echo "Ready for production deployment"
 
-
-
   # Notify stakeholders
   notify:
     name: Notify Release

Dockerfile

@@ -22,26 +22,27 @@ FROM python:3.11-slim
 # Set working directory
 WORKDIR /app
 
-# Install runtime dependencies
+# Install runtime dependencies and create user
 RUN apt-get update && apt-get install -y \
     wget \
     curl \
     && rm -rf /var/lib/apt/lists/* \
-    && groupadd -r appuser && useradd -r -g appuser appuser
+    && groupadd -r appuser && useradd -r -g appuser appuser \
+    && mkdir -p /home/appuser/.local
 
 # Copy Python packages from builder stage
-COPY --from=builder /root/.local /root/.local
+COPY --from=builder /root/.local /home/appuser/.local
 
 # Copy application code
 COPY . .
 
 # Create logs directory and set permissions
-RUN mkdir -p logs && chown -R appuser:appuser /app
+RUN mkdir -p logs && chown -R appuser:appuser /app /home/appuser/.local
 
 # Set environment variables
 ENV PYTHONUNBUFFERED=1
 ENV TZ=Asia/Bangkok
-ENV PATH=/root/.local/bin:$PATH
+ENV PATH=/home/appuser/.local/bin:$PATH
 
 # Switch to non-root user
 USER appuser