fix(docker): stop the container entrypoint printing database connection strings in logs

[ericallam]

Summary

The container entrypoint runs under set -x, which echoes every command to the logs with its variables expanded. Several startup guards reference full database connection strings, so the DSN (including the password) was printed to the container logs on every boot. This turns tracing off around those lines so connection strings are never traced, while leaving migration behavior and ordinary startup logging unchanged.

Fix

The leaking lines are the [ -n "$RUN_OPS_DATABASE_URL" ] and [ -n "$RUN_OPS_LEGACY_DIRECT_URL" ] guards, and the ClickHouse block (its [ -n "$CLICKHOUSE_URL" ] guard plus the lines that build GOOSE_DBSTRING from CLICKHOUSE_URL). set -x prints each of these with the credential expanded. Tracing is now disabled around each region and restored afterward, so non-secret tracing is preserved everywhere else. The existing legacy-migration subshell already protected its own command body; this adds the missing protection for the guards and the ClickHouse block.

{ set +x; } 2>/dev/null
if [ -n "$RUN_OPS_DATABASE_URL" ]; then
  set -x
  ...

Verification

Built the webapp image and ran it with dummy sentinel connection strings whose password token is S3NTINEL_PW_DoNotLog, then grepped the boot logs.

Before (unmodified), the token appears in the traced guards:

+ [ -n postgresql://user:S3NTINEL_PW_DoNotLog@fake-host:6432/run-ops ]
+ [ -n postgresql://user:S3NTINEL_PW_DoNotLog@fake-host:5432/legacy ]
+ [ -n https://default:S3NTINEL_PW_DoNotLog@fake-host:8443 ]

After, grep S3NTINEL_PW_DoNotLog on the same run returns nothing, and the normal "skipping ... migrations" lines still log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 690a572

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Walkthrough

Container startup now disables shell tracing while evaluating database and ClickHouse migration configuration, preventing credential-bearing connection strings from being logged. Tracing is restored for migration commands, skip messages, Prisma file copying, and server startup. A changelog entry records the webapp fix.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the fix and verification, but it misses the template's Closes line, checklist, testing, changelog, and screenshots sections.	Add the required template sections: Closes #issue, checklist items, Testing steps, Changelog summary, and Screenshots placeholder.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: preventing database connection strings from being logged by the Docker entrypoint.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/entrypoint-no-trace-db-dsn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.