Official way to run page save compaction on hardened backend images?

💬 Self Hosted Retool
1

Hi,

I am moving a self-hosted deployment from tryretool/backend:4.34.2-stable to tryretool/backend:4.34.2-stable-hardened. The documented page save compaction command does not work on the hardened image, and I could not find a hardened-specific version of it in the docs.

The documented command is:

./retool_backend --run-pagesave-compaction

What differs between the two images

In the classic image, /retool_backend/retool_backend is a bash script that forwards its arguments:

#!/bin/bash
node bundle/main.js "$@"

In the hardened image, the same path holds a file with no shebang, and it does not forward arguments:

cd /retool_backend/.bazel/backend
./onprem-oci "bazel-out/k8-fastbuild/bin/oci/onprem/onprem_retool_backend"

Consequence

Direct invocation fails, because there is no shebang:

$ docker run --rm --platform linux/amd64 -w /retool_backend \
    --entrypoint ./retool_backend \
    tryretool/backend:4.34.2-stable-hardened --run-pagesave-compaction
exec ./retool_backend: exec format error

My question

What is the supported way to run page save compaction on the hardened images?

Is there a stable entry point for maintenance commands on the hardened images? Or could the wrapper forward its arguments?

Thanks.

2

Summary

On a self-hosted deployment being migrated from the classic backend image (tryretool/backend:4.34.2-stable) to the hardened image (4.34.2-stable-hardened), the documented page save compaction command ./retool_backend --run-pagesave-compaction fails with an 'exec format error' because the hardened image's entry point is a Bazel-built OCI binary that has no shebang and does not forward arguments like the classic bash wrapper does.

AI Response

This behavior stems from a fundamental design difference rather than a bug. Hardened images are built with Bazel on a minimal Wolfi/Chainguard base, so the file layout, users/permissions, and entry point differ from the Debian-based classic images, and nonessential shell tooling is intentionally removed. As a result, the classic invocation pattern (relying on the bash wrapper to forward arguments to node bundle/main.js) does not carry over, which is exactly why direct invocation returns an exec format error. The published documentation confirms these entry-point and tooling changes but does not currently document a hardened-specific command for running page save compaction, so there is no verified alternative invocation to share at this time. Reviewing the hardened images guidance below is the best-supported next step for validating maintenance workflows on the hardened tags.

Sources

:bookmark: Hardened images for self-hosted Retool | Retool Docs
Explains that hardened images are Bazel-built OCI images on a Wolfi/Chainguard base with a different entry point, curated system packages, and no in-container shell tooling — directly accounting for why the classic compaction command fails.
:bookmark: Hardened images available in stable channel
The official product update announcing hardened images in the stable channel, with migration guidance and a note to identify any current reliance on shell access or system tools before rolling out.

The Community Team is testing out a new automation. Let us know if it's helpful (or not) by leaving a :heart:, :+1:, or :-1:. Or by marking this post as the "Solution"! Let us know if you have any feedback here. :rocket:

3

Hey @Gloubiboulga - this feels like a bug, but I'll want to confirm that with the team. In the meantime, have you tried direct invocation against onprem-oci? Something like:

docker run --rm --platform linux/amd64 \
  -w /retool_backend/.bazel/backend \
  --entrypoint ./onprem-oci \
  tryretool/backend:4.34.2-stable-hardened --run-pagesave-compaction