27 lines
1.2 KiB
Markdown
27 lines
1.2 KiB
Markdown
# 7. Sandboxes proxy uploads; never copy the media library
|
|
|
|
- **Status:** Accepted
|
|
- **Date:** 2026-08-15
|
|
|
|
## Context
|
|
|
|
The MVP must preview a change in under five minutes. A WooCommerce store with years of posts and a 2GB media library cannot be copied in time — warm pool hides boot, not copy (R4). A full mirror also copies customer PII and secrets (R10).
|
|
|
|
## Decision
|
|
|
|
Task-scoped DB subset (content tables only, drop orders/comments/transients, redact `*_key`/`*_secret`/`smtp_pass`) plus an origin proxy for `/wp-content/uploads/*`. A file is copied into the sandbox only when the agent replaces it. Full-library copy is not a v1 path, even for 20GB+ sites.
|
|
|
|
### Options considered
|
|
|
|
- Full mirror + lazy media sync.
|
|
- Proxy uploads, subset content tables.
|
|
|
|
### Rejected
|
|
|
|
- Full mirror — the synthetic 2GB timing shows subset+proxy is ~0.01ms vs 2.4s+ to copy the blob locally (worse over a network); and it drags PII into a container with outbound internet.
|
|
|
|
## Consequences
|
|
|
|
- `subset.ts` and `media-proxy.ts` implement the decision and are unit-tested; `run-mirror-timing.ts` records the p50/p95 evidence.
|
|
- A real-host pull of the content slice is the unproven part; if it exceeds 60s, shrink the slice further — do not start copying uploads.
|