Does npx partykit dev make external requests?

[man-shar]

Hello all!

We have packaged partykit into a docker container, but it only runs npx partykit dev and is not deployed to partykit's servers.

We had a security question come up: Does the dev command of partykit send data to any external server apart from the ones connected to it via partykit, eg cloudflare, etc?

Thank you!

[threepointone]

I think miniflare (which wraps workerd) makes an initial request so it can populate request.cf for local dev. There could be a way to prepopulate it/disable it, but I haven't looked into it just yet. No other requests that I can think of, but I'll ask the miniflare/workerd folks to confirm.

Running partykit in a docker container is cool, I was planning on working on it later this year for on-prem deployments. Are you using this just for testing or are you looking at production deploys too?

[man-shar]

Hmm, got it. Thanks! Will wait to see what miniflare folks say.

Re docker: We do use local dev for prod deploys too. Easier to manage and obviously has no security/data sharing concerns that a deploy would.

We don't have a use case for a deployed party I think. Only need it for basic yjs doc state sharing. And all users connect to the docker ctr itself.

[threepointone]

Fascinating. Would you be up for doing a short call so I can understand this more? https://cal.com/threepointone/30min Whenever's convenient for you. partykit dev isn't super optimised for production deploys, so maybe I can do stuff here that would make it better.

[man-shar]

Yep, sure! Will setup a meeting.

[threepointone]

Ok, I can confirm that miniflare makes no other requests, and I could add a flag to disable that behaviour if it's a problem for you?

[threepointone]

Would this work for you? --disable-request-cf-fetch #814

[man-shar]

That should be perfect! Thank you!

[threepointone]

landed the PR, available in partykit@0.0.92!

[man-shar]

amaze, thanks! closing this discussion.