Infra/Docker: homelab-only entrypoint, test-DB mutation, USER import side effect, prod==test image

[codenamekt]

Summary

The container image and entrypoint carry homelab-specific assumptions and a few footguns that make the published image hard to use standalone.

Findings

HEXUS_DB_PASS hard-required before profile dispatch (high)

docker/entrypoint.sh:24 — ${HEXUS_DB_PASS:-${MEMORY_PGVECTOR_DB_PASS:?…}} runs unconditionally under set -eu. Even CMD_PROFILE=shell (the image default, Dockerfile:97) dies with "hexus database password required" — docker run hexus:latest can't even give a debug shell, and it's required even when a full HEXUS_DSN is supplied.

CMD ["shell"] is a decoy; typo'd profile silently drops to bash (medium)

Dockerfile:125 vs entrypoint.sh:16,110 — the entrypoint dispatches only on the CMD_PROFILE env var and ignores $1, so docker run hexus mcp still runs shell; shell|* means a typo'd CMD_PROFILE=mpc silently becomes bash (exits immediately when detached).

Test profile permanently alters the target DB (medium)

docker/entrypoint.sh:86 — ALTER DATABASE … SET enable_indexscan = off; persists on the database. Pointing PG_TEST_DSN at any shared/real DB (which the homelab-db defaults encourage) silently disables index scans for all future connections.

os.environ.setdefault("USER", "agy") import side effect (medium)

hexus/embedder.py:33 — a hardcoded homelab username is mutated into the process environment at import, leaking into HF cache paths, getpass.getuser(), and subprocesses for every consumer of the library.

Production image == test image (medium)

Dockerfile:119 + compose.yml:71 — the runtime stage ships tests/, pytest, and postgresql-client; the mcp service uses tag hexus:test, and CI pushes that same image to GHCR (ci.yml:62).

Dead code / stale comments (low)

entrypoint.sh:49-65 wait_for_schema() is defined and never called; compose.yml:23,52,78 reference a /app/pgvector/migrations/ path that no longer exists (actual: /app/hexus/migrations).

Note: the compose mcp profile missing PG_TEST_HOST: pg (would hang on homelab-db) is being fixed in #6.

Suggested direction

Only require a DB password on profiles that need it; make CMD_PROFILE respect $1 or fail on unknown profiles; scope the enable_indexscan tweak to a session SET (not ALTER DATABASE); drop the hardcoded USER default (or gate it); build a slim runtime image without tests/pytest for GHCR; remove dead code / fix stale comments.

Filed from the 2026-07 codebase review.