fix(cli): keep custom base images' own trust store

Fixes `trigger deploy` failing on self-hosted instances that set custom
base images with `DEPLOY_BASE_IMAGES` or `DEPLOY_BUILD_BASE_IMAGES`
(#5054). The deploy step that distrusts compromised emSign certificate
authorities assumed the published root Debian images, so it broke on
non-root or non-Debian bases such as Chainguard's.

Stages built on a custom image now skip that step and keep the
certificate settings the image ships with. Stages on the published
images are unchanged. The self-hosting docs now state that a custom base
image owns its own security hardening.

Mono-RevId: 5de0cdda76e9b57d7b076d52c6ab8c763934e2d3

Author: nicktrn

.changeset/custom-base-image-trust-store.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Fix `trigger deploy` failing on self-hosted instances with custom base images. Stages built on a custom image now keep the trust store that image ships with.

docs/self-hosting/overview.mdx

@@ -121,6 +121,8 @@ You own a custom base image. It must provide:
 
 A `DEPLOY_BUILD_BASE_IMAGES` image needs everything the base image provides, plus `python3`, `make` and `g++`. Build extensions that add image instructions are replayed on it. Without an entry, the build stage uses the published build image, except for projects whose build extensions add image instructions: those build from your base image and install the toolchain with `apt-get`, so that base must be Debian-based. To avoid the published images entirely, set both variables.
 
+A custom image is yours to harden. Deploys on the published images remove trust in publicly compromised certificate authorities and point Node.js and Python at the OS trust store. Stages built on a custom image get neither, and run with the certificate settings the image ships with. Keeping a custom image patched, trust store included, is your responsibility.
+
 <Warning>
   `image.pkgs` and build extensions that run `apt-get` (such as `aptGet` and `playwright`) assume a
   Debian base. On other distributions, install those packages in your base image instead.

packages/cli-v3/src/deploy/buildImage.test.ts

@@ -492,4 +492,78 @@ describe("generateContainerfile", () => {
     expect(containerfile).toContain("FROM base AS build");
     expect(containerfile).toContain(TOOLCHAIN_PACKAGES);
   });
+
+  it.each(["node", "bun"] as BuildRuntime[])(
+    "leaves the trust store of configured base and build images alone on %s",
+    async (runtime) => {
+      const containerfile = await generateContainerfile({
+        runtime,
+        build: {},
+        image: {
+          base: "acme/node-fips:26@sha256:abc",
+          buildBase: "acme/node:26-dev@sha256:def",
+        },
+        indexScript: "index.js",
+        entrypoint: "entrypoint.js",
+      });
+
+      expect(distrustSteps(containerfile)).toHaveLength(0);
+      expect(rejectSteps(containerfile)).toHaveLength(0);
+      expect(containerfile).not.toContain(EMSIGN_REJECT_DIR);
+      expect(containerfile).not.toContain("--use-openssl-ca");
+      expect(containerfile).not.toMatch(osTrustStoreEnv);
+    }
+  );
+
+  it("hardens only the published build image when just the base is configured", async () => {
+    const containerfile = await generateContainerfile({
+      runtime: "node-26",
+      build: {},
+      image: { base: "acme/node-fips:26@sha256:abc" },
+      indexScript: "index.js",
+      entrypoint: "entrypoint.js",
+    });
+
+    const buildStart = containerfile.indexOf(`FROM ${BUILD_IMAGE["node-26"]} AS build`);
+    const steps = Array.from(containerfile.matchAll(/^ {2}update-ca-certificates --fresh$/gm));
+
+    expect(steps).toHaveLength(1);
+    expect(steps[0]!.index).toBeGreaterThan(buildStart);
+    expect(containerfile).toContain('NODE_OPTIONS="--max_old_space_size=8192 --use-openssl-ca"');
+  });
+
+  it("hardens only the published base image when just the build image is configured", async () => {
+    const containerfile = await generateContainerfile({
+      runtime: "node-26",
+      build: {},
+      image: { buildBase: "acme/node:26-dev@sha256:def" },
+      indexScript: "index.js",
+      entrypoint: "entrypoint.js",
+    });
+
+    const buildStart = containerfile.indexOf("FROM acme/node:26-dev@sha256:def AS build");
+    const steps = Array.from(containerfile.matchAll(/^ {2}update-ca-certificates --fresh$/gm));
+
+    expect(steps).toHaveLength(1);
+    expect(steps[0]!.index).toBeLessThan(buildStart);
+    expect(containerfile).toContain('NODE_OPTIONS="--max_old_space_size=8192"');
+  });
+
+  it("leaves the trust store alone when the build stage derives from a configured base", async () => {
+    const containerfile = await generateContainerfile({
+      runtime: "node-26",
+      build: {},
+      image: {
+        base: "acme/node-fips:26@sha256:abc",
+        instructions: ["RUN echo custom > /etc/marker"],
+      },
+      indexScript: "index.js",
+      entrypoint: "entrypoint.js",
+    });
+
+    expect(containerfile).toContain("FROM base AS build");
+    expect(distrustSteps(containerfile)).toHaveLength(0);
+    expect(rejectSteps(containerfile)).toHaveLength(0);
+    expect(containerfile).not.toContain("--use-openssl-ca");
+  });
 });

packages/cli-v3/src/deploy/buildImage.ts

@@ -761,6 +761,10 @@ RUN sed -i -E 's#^(mozilla/(${EMSIGN_COMPROMISE_DISTRUSTED_ROOTS.join(
 ENV NODE_OPTIONS=--use-openssl-ca
 ENV SSL_CERT_FILE=\${SSL_CERT_FILE:-${OS_TRUST_STORE}} REQUESTS_CA_BUNDLE=\${REQUESTS_CA_BUNDLE:-${OS_TRUST_STORE}} PIP_CERT=\${PIP_CERT:-${OS_TRUST_STORE}}`;
 
+// A custom base image owns its own hardening, trust store included
+const trustStoreHardening = (customImage: string | undefined) =>
+  customImage ? "" : distrustCompromisedRoots;
+
 export async function generateContainerfile(options: GenerateContainerfileOptions) {
   switch (options.runtime) {
     case "node":
@@ -829,23 +833,28 @@ const parseGenerateOptions = (options: GenerateContainerfileOptions) => {
 
   // Instructions run once (FROM base) since their downloads are unbounded;
   // package-only projects keep the prebuilt toolchain and repeat the small install
-  const buildStage =
-    baseInstructions && !options.image?.buildBase
-      ? `FROM base AS build
+  const buildFromBase = Boolean(baseInstructions) && !options.image?.buildBase;
+  const buildStageCustomImage = buildFromBase ? options.image?.base : options.image?.buildBase;
+
+  const buildStage = buildFromBase
+    ? `FROM base AS build
 
 RUN apt-get update && \\
   apt-get install -y --no-install-recommends ${TOOLCHAIN_PACKAGES} && \\
   apt-get clean && \\
   rm -rf /var/lib/apt/lists/*`
-      : `FROM ${options.image?.buildBase ?? BUILD_IMAGE[options.runtime]} AS build
+    : `FROM ${options.image?.buildBase ?? BUILD_IMAGE[options.runtime]} AS build
 
 ENV DEBIAN_FRONTEND=noninteractive${customization ? `\n\n${customization}` : ""}
 
-${distrustCompromisedRoots}`;
+${trustStoreHardening(options.image?.buildBase)}`;
 
   return {
     baseImage: options.image?.base ?? BASE_IMAGE[options.runtime],
     buildStage,
+    indexerNodeOptions: buildStageCustomImage
+      ? "--max_old_space_size=8192"
+      : "--max_old_space_size=8192 --use-openssl-ca",
     customization,
     buildArgs,
     buildEnvVars,
@@ -865,7 +874,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 ${customization}
 
-${distrustCompromisedRoots}
+${trustStoreHardening(options.image?.base)}
 
 ${buildStage}
 
@@ -957,8 +966,15 @@ CMD []
 }
 
 async function generateNodeContainerfile(options: GenerateContainerfileOptions) {
-  const { baseImage, buildStage, buildArgs, buildEnvVars, postInstallCommands, customization } =
-    parseGenerateOptions(options);
+  const {
+    baseImage,
+    buildStage,
+    indexerNodeOptions,
+    buildArgs,
+    buildEnvVars,
+    postInstallCommands,
+    customization,
+  } = parseGenerateOptions(options);
 
   return `# syntax=docker/dockerfile:1
 # check=skip=SecretsUsedInArgOrEnv
@@ -968,7 +984,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 ${customization}
 
-${distrustCompromisedRoots}
+${trustStoreHardening(options.image?.base)}
 
 ${buildStage}
 
@@ -1027,7 +1043,7 @@ ENV TRIGGER_PROJECT_ID=\${TRIGGER_PROJECT_ID} \
     TRIGGER_LOG_LEVEL=debug \
     NODE_EXTRA_CA_CERTS=\${NODE_EXTRA_CA_CERTS} \
     NODE_ENV=production \
-    NODE_OPTIONS="--max_old_space_size=8192 --use-openssl-ca"
+    NODE_OPTIONS="${indexerNodeOptions}"
 
 ARG TARGETPLATFORM
 ARG BUILDPLATFORM