Yeogieottae Secret Platform Build Story Part 3: Turning the Secret Store into an Operable Service - From Containerization to CI/CD and Log Collection

To make Secrethub operable on top of Bun, build, deployment, and observability were standardized at the platform level.

In bunfig.toml, linker = "isolated" was used to configure node_modules without symbolic links. On top of this, bun build was applied to turn TypeScript and dependencies into a single bundle (dist/index.js), and the runtime image was organized to contain only the build output, without the source code or node_modules.

The multi-stage Dockerfile was also structured in the same direction. Dependency installation and bundling are finished in the build stage, and only dist/ is copied into the runtime stage, reducing image size and simplifying the runtime.

CI/CD was organized into the following flow.

• GitLab Push
• Lint / Build / Test on GitLab Runner
• Build container image, then push to ECR
• Upload deployment script to S3
• Trigger CodeDeploy
• Update via docker compose pull and up on EC2

Unlike existing EC2 projects that operated separate deployment scripts per service centered on Jenkins, a common GitLab CI template was also applied to EC2. CI logic is managed by the DevOps team, and services were changed to declare only minimal configuration such as project name and ECR image name, standardizing the deployment structure.

CD was composed with a CodeDeploy + Docker Compose combination. ApplicationStop is used to stop running containers, and BeforeInstall is used only for pre-installation preparation, separating the responsibilities of the hooks. Operational independence was also increased so that even if the server reboots or is replaced with a new EC2 instance, recovery can be completed entirely with just the deployment script.

For observability, instead of an application-specific logging library, the approach chosen was to send Docker log directly via the Loki Driver. In an environment where multiple containers run together on a single EC2, it's better to collect consistently at the container level regardless of language/framework, and it's also easy to standardize with a Docker Compose template.

Currently, about 40% of Yeogieottae's EC2 services remain, and a transition to EKS is underway in the long term. So by standardizing CI first, only CD needs to change when moving to EKS, and the plan is to also transition Secrethub to a common EKS cluster after it stabilizes.