Deploy previews

​

Choose a mode

levelrail-cli preview enable web --mode metadata
levelrail-cli preview enable web --mode screenshot --path /pricing
levelrail-cli preview disable web
levelrail-cli preview status web
levelrail-cli preview capture web

​

What the metadata mode does

• Requests the configured path (default /) on the app itself, through the app’s published loopback port, the same route the ingress uses. It never contacts the public internet for the page, and you never supply a URL, only a path.
• Sends no cookies or credentials. A 401 or 403, or a redirect to a login page, is recorded as skipped with a reason. Redirects that leave the app are refused, and at most 3 are followed.
• Reads at most 512 KB of HTML with a real HTML tokenizer and keeps the title, og:title, og:description, og:image, twitter:image, theme-color and icon links.
• If there is an og:image (or twitter:image), it is resolved against the page, must be an http or https URL, and is downloaded through the same outbound guard the webhooks use: loopback, private, link-local and metadata-service addresses are refused at connect time, including after redirects. The app’s own origin and its own domains are read from the app itself. Limit 2 MB.
• JPEG and PNG images are supported. The image is decoded, scaled down to fit 640 by 400 (never up) and centered on a neutral background, then stored as a JPEG. Images under 120 pixels on a side and single-color images are rejected.
• When there is no usable image, the preview is a card: the deploy history composes it from the page title, description and theme color, with the app name and commit. A card stores about 100 bytes of text and no image file.

​

What a screenshot capture does

• Pulls the browser image the first time it is needed (docker.io/chromedp/headless-shell, pinned to a version, about 140 MB compressed).
• Starts one container with a 512 MB memory cap, 1 CPU, a read-only root filesystem, a small tmpfs, all capabilities dropped, a non-root user and a process limit.
• Attaches it to the app’s own Docker network and nothing else. It reaches the app by service name and port. You never supply a URL, only a path on the app.
• Loads the page at 1280x800 without cookies or credentials, waits for the page to settle (at most about 10 seconds), takes a screenshot, and stops the container. The whole capture has a 30 second limit.
• Shrinks the screenshot to a 640 pixel wide JPEG, usually 20 to 60 KB.

​

Cost

​

Privacy

• Metadata is on by default and screenshots are opt-in. The default reads only the public head of your page and, at most, one image the page itself names. A screenshot is never taken unless you choose it for that app.
• Internal pages can leak. If the path you pick shows internal data to anyone who can reach the app, the thumbnail shows it too. Pick a public page, such as /.
• The browser never logs in. It sends no cookies and no tokens, and a 401 or 403, or a redirect to a login page, is recorded as skipped with no image stored.
• The image has the same access as the app. It is served only to people who can read the app, through the authenticated API. It is never public and never appears on the public status page.
• This is not a sandbox for hostile apps. The page is loaded by a real browser next to the app. The container limits above contain a browser bug, but only capture apps you run.
• The browser’s debugging port is published on the host loopback interface for the length of a capture, on a random port, so other processes on the host can reach it during that window.

​

What is skipped

​

Retention and cleanup

• The newest 5 previews of each app are kept, plus the preview of the release now serving.
• Previews older than 30 days are deleted, except the live release’s.
• If all previews together pass 200 MB, the least recently viewed go first.
• Previews are deleted when the app is deleted.
• Every capture container carries a role label. On startup and every hour, any older than twice the capture timeout (left by a crash) is removed.
• The browser image is removed after 14 idle days, or at the next cleanup pass once the server switch is off, but only if this control plane pulled it and no container uses it. An image you pulled yourself is never touched.
• Prune now (or levelrail-cli preview prune <app>) applies these rules immediately. --all deletes every preview of the app.

​

Settings

​

API

​

Limits

• Local node only. Apps on other nodes are skipped.
• Screenshots skip apps without a per-app network or a declared port. Metadata needs only a running container with a published port.
• WebP and other formats are not decoded for site images, only JPEG and PNG.
• The page is requested by service name, so an app that routes by Host header shows its default site.
• Only the viewport is captured, not the full page. Cookie banners and late-loading content appear as the app renders them.