Publish a new cap-web Docker image with the R2 multipart fixes (#2275) #2384

Activity

1. linear commented on Sep 29, 2026

   

   linearBot

   on Sep 29, 2026 – with Linear

   More actions

   CAP-830
2. nikhilanu commented on Oct 21, 2026

   

   nikhilanu

   on Oct 21, 2026

   Last edited by nikhilanu

   More actions

   Sharing what I have seen on a self-hosted install with Cloudflare R2, in case it's useful:

   • We built cap-web from main (57369c4). Long recordings from Record in Browser now upload fine for us, and the desktop app (Instant and Studio) works too.
   • With the Chrome extension, we still see InvalidPart: All non-trailing parts must have the same length on recordings longer than about a minute. Chrome shows version 1.0.3 after a forced update, and the uploaded parts were uneven (5.26–5.89 MB), so we wondered whether the store version predates the fix.

   Is a new cap-web image and extension release planned? ghcr.io/capsoftware/cap-web:latest still looks like the 2026-09-07 build.
3. prosomoalexd commented on Oct 28, 2026

   

   prosomoalexd

   on Oct 28, 2026

   More actions

   Same situation on our self-hosted install (Kubernetes, S3-compatible storage). We run ghcr.io/capsoftware/cap-web@sha256:8ee4cbd3…, the 2026-09-07 build from c5f22d7, and the Chrome Web Store extension 1.0.3.

   • We hit Self-hosted + Cloudflare R2: camera-only Instant recordings fail with "InvalidPart: All non-trailing parts must have the same length" #2275 as well: a 5-minute browser recording failed at /api/upload/multipart/complete (four 500s, InvalidPart) while our videos were on R2. We moved video storage to Backblaze B2 to get around it.
   • Since that build, main has merged other fixes we'd like to deploy from an official image: fix(auth): invalidate email OTP on a failed guess, not just a match #2224 (a wrong OTP guess now consumes the code), fix: serve public assets on self-hosted deployments #2266 (public assets no longer redirected to /login), fix(email): don't send from auth@undefined and report when email isn't configured #3003 (sign-in screen says when email isn't configured), fix(self-hosting): validate DATABASE_ENCRYPTION_KEY at startup #2470 (DATABASE_ENCRYPTION_KEY validation at startup), plus fix(web): require same-site requests for cookie-authenticated writes and set frame headers on app pages #2997, fix(web): add baseline security response headers #1934, fix(web): check private space access before sharing Caps #2883 and fix(web): pin Docker base image to Node 24.22.1 security release #2875.

   Two asks that would make upgrades safer for self-hosters:

   1. Publish cap-web with an immutable per-commit tag (for example sha-<shortsha>) alongside latest, so we can pin and roll back without tracking digests.
   2. Build cap-web and cap-media-server from the same commit, or say which media-server revision a given web image goes with. Today the two latest tags pair a 2026-09-07 web image with a 2026-10-26 media server.

   A Chrome Web Store release would help too: 1.0.3 is from 2026-07-19, and @nikhilanu's report above suggests the R2 part-size fix hasn't reached the extension yet.

   If the per-commit tag is welcome, I'm happy to send a PR for docker-build-web.yml.