feat: Phase 14/15 — Cloudflare Containers setup for graph-server

[cdxker]

Summary

• Consolidate pnpm lockfiles to workspace root, removing per-package lockfiles
• Add Cloudflare Containers infrastructure: Dockerfile, .dockerignore, container entry point (container-entry.ts), and CF Worker entry (container-worker.ts)
• Configure wrangler.toml with staging containers environment and Durable Object migration (new_sqlite_classes)
• Expose staging Postgres on 0.0.0.0:5433 via docker-compose.yaml for container access
• Install @cloudflare/containers and updated workers-types
• Update Phase 15 ticket docs with credentials, migration field, and deploy caveats

Test plan

• Verify pnpm install works correctly from workspace root
• Build the Docker image from graph-server/Dockerfile and confirm it starts
• Deploy to staging with wrangler deploy and verify container worker routes
• Confirm Durable Object migration applies cleanly on free plan
• Validate staging Postgres is reachable from container at host.docker.internal:5433

🤖 Generated with Claude Code

---

Note

High Risk
Exposes a Postgres instance on 0.0.0.0:5433 and commits database credentials in docker-compose.yaml, which increases the risk of unintended external access or credential leakage.

Overview
Adds a new postgres-staging service to docker-compose.yaml, with its own persistent volume, explicit port publish (0.0.0.0:5433:5432), and listen_addresses=* so it can be reached externally (e.g., by remote containers).

^{Written by Cursor Bugbot for commit 0aa75f3. This will update automatically on new commits. Configure here.}

[cdxker]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Hardcoded staging database password committed to repo

High Severity

A non-trivial password (kX9#mQ2$vL7nR4wB) for the staging Postgres database is hardcoded in docker-compose.yaml, which is committed to version control. Combined with the service binding to all interfaces (0.0.0.0:5433) and the ticket docs referencing a public IP (216.38.137.154:5433), this exposes the staging database credentials to anyone with repo access. The existing dev postgres service uses obvious default credentials, but the staging password appears to be a real secret. It would be better managed via environment variable substitution or a .env file (which is already gitignored).

 

[cursor]

Dollar sign in password triggers variable interpolation

High Severity

Docker Compose performs variable interpolation on $ signs in YAML values. The password "kX9#mQ2$vL7nR4wB" contains $vL7nR4wB, which Compose will interpret as a reference to the environment variable vL7nR4wB. Since that variable almost certainly isn't set, it silently resolves to an empty string, making the effective password kX9#mQ2 instead of the intended value. This will cause any application using the full password string to fail to connect. The $ needs to be escaped as $$.