Skip to main content
feather security-check passes. Run it on the server against the live file: feather security-check --env-file .env
SECRET_KEY is a real random value, not the scaffolded placeholder.
FLASK_CONFIG=production — set by compose. Confirm with docker compose exec web printenv FLASK_CONFIG
TRUSTED_HOSTS lists the hostnames you serve, so Host-header spoofing cannot forge absolute URLs in emails and redirects.
OAUTH_CALLBACK_URL uses https:// and the exact hostname, www included — and matches the redirect URI in the Google Cloud Console.
JOB_SERIALIZER=json — the default in the generated compose file. pickle will unpickle arbitrary objects off Redis. Only switch if a job argument genuinely cannot be JSON-encoded.
.env on the server is chmod 600 and not in git.
feather env check reports no missing keys.
A database that is not SQLite, with deploy/backup.sh in cron and one restore actually tested.
An external uptime monitor pointed at https://<domain>/health
docker compose logs capped. The generated file sets max-size: 20m and max-file: 3. Docker’s default grows until the disk fills.
Server backups or snapshots enabled at the provider as well.

​
Upgrading from feather deploy render

0.9.7 removed feather deploy render. Your existing Dockerfile and render.yaml are your files and keep working — nothing was deleted from your repo. To adopt the new layout, run feather docker init; it will not overwrite anything without --force.
One change matters even if you stay where you are. Replace the absolute @source line in static/css/app.css with:
and add .feather-templates to .gitignore. Older scaffolds baked the absolute path of the installed Feather package into that file, so images built anywhere but the machine that ran feather new silently lack every framework component style.