a0deploy error attack protection settings rejected fails

Not specified by the original author.

TL;DR

Don't change code until you've classified the failure from the app's logs: the app owner opens them from the "Manage app" menu (bottom-right of the deployed app). Log lines: ❗️ installer returned a non-zero exit code / ❗️ Error during processing dependencies! Please fix the error and push an update, or try restarting the app.

import streamlit as st

value = st.secrets.get("api_key")
if not value:
    st.error("Missing 'api_key' in app secrets (workspace → app ⋮ → Settings → Secrets).")
    st.stop()

When to use

You are seeing this: Match what you see against the four signatures below. Use this skill when you run into "Classify and fix Streamlit Community Cloud deployment failures".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: pandas 2.2.3. If you are on something much newer or older, the details may have shifted.

Use this when an app runs locally but fails on Streamlit Community Cloud (share.streamlit.io), or when a deployed app that used to work now shows an error page. Don't change code until you've classified the failure from the app's logs: the app owner opens them from the "Manage app" menu (bottom-right of the deployed app). Match what you see against the four signatures below.

1. The four signatures

• A. Dependency failure at build time. Log lines: ❗️ installer returned a non-zero exit code / ❗️ Error during processing dependencies! Please fix the error and push an update, or try restarting the app. The app never starts.

• B. Runtime crash after start. The app builds, then shows "Oh no. Error running app.", or the log says ❗️ Streamlit server consistently failed status checks / ❗️ Please fix the errors, push an update to the git repo, or reboot the app. The traceback in the logs names the real exception.

• C. Resource exhaustion. The app shows "This app has gone over its resource limits." Community Cloud gives each app 1 GB of RAM; exceeding it kills the app, often mid-session.

• D. Secrets/config missing. Works locally, fails on Cloud with a KeyError from st.secrets[...] or a connection error to a private service.

2. Fix A: dependency install failures

• requirements.txt is the supported path; pin versions (pandas==2.2.3) so a fresh solve can't drift. A common failure: a package that installs fine locally fails on Cloud because the local machine had a cached wheel or a system library the Cloud image lacks.

• environment.yml (conda) is a frequent trap: the conda solver can exhaust the 1 GB build memory and get OOM-killed (bash: line 3: 11 Killed ... conda env update), even for packages pip would install fine. Prefer requirements.txt; use conda only if a package truly has no pip wheel.

• Non-Python system libraries (e.g. libgl1 for OpenCV, tesseract-ocr) go in packages.txt at the repo root, one apt package name per line. They are installed with apt before pip runs.

• Set the Python version under Advanced settings at deploy time, and reproduce failures locally with that same version.

3. Fix B: runtime crashes

• Read the traceback in the logs, not the "Oh no" page. It usually names a missing file, a wrong relative path (the working directory on Cloud is the repo root; on your machine you may have run Streamlit from a subfolder), or an unhandled exception in a code path local testing never hit.

• Pushing a fix redeploys automatically. If the app looks stuck after a push, reboot from the ⋮ menu → "Reboot app".

4. Fix C: over resource limits

Rebooting clears it temporarily; the fix is using less memory:

• Don't hold the full raw dataset in memory. Downcast dtypes (object → category, float64 → float32), drop unused columns, aggregate before caching.

• Give caches a ttl so stale entries expire instead of accumulating: @st.cache_data(ttl=3600).

• Load heavy artifacts (model weights) once via @st.cache_resource, not once per session.

• If the dependency install itself gets killed, that's signature A, not C fix the environment, not the code.

5. Fix D: secrets

• Never commit .streamlit/secrets.toml, add it to .gitignore. On Cloud, paste the file's TOML contents into the "Secrets" field under Advanced settings while deploying; for an already-deployed app, go to the workspace, the app's ⋮ menu → Settings → Secrets. The app restarts and picks them up.

• Read secrets in code through indirection, and fail legibly when one is absent:

import streamlit as st

value = st.secrets.get("api_key")
if not value:
    st.error("Missing 'api_key' in app secrets (workspace → app ⋮ → Settings → Secrets).")
    st.stop()

6. Checklist

1. Open the logs (Manage app) and match the signature: dependency (A), runtime (B), resources (C), secrets (D).

2. A → pin requirements.txt, drop conda unless unavoidable, system libs in packages.txt, match the Python version.

3. B → read the traceback; check relative paths and untested code paths.

4. C → reboot is triage; shrink memory (dtypes, ttl, lazy loads) for the cure.

5. D → secrets via app settings, never committed; .gitignore the local file.

Built from Streamlit Community Cloud forum reports (dependency install failures, 'Streamlit server consistently failed status checks', 'This app has gone over its resource limits' with the 1 GB limit, conda solver OOM-kills) and the official Streamlit docs on secrets management for Community Cloud (Advanced settings Secrets field, .streamlit/secrets.toml gitignored, workspace app settings).

Not specified by the original author.

TL;DR

The fix was backend-side, so updating the CLI alone (1.29.3) did not help. What actually fixes it (verified in the thread): Update your self-hosted backend , Convex shipped a new backend release that resolves this; both reporters confirmed deploys succeed against the updated backend.

Steps

1. With convex 1.29.2 (and 1.29.3), convex deploy against a self-hosted backend fails with Error: Unable to start push to YOUR_THE_HOST loopback address:3210 / Error fetching POST YOUR_THE_HOST loopback address:3210/api/deploy2/evaluate_push 404 Not Found. The identical command works with 1.29.1.
2. What actually fixes it (verified in the thread):
3. Update your self-hosted backend , Convex shipped a new backend release that resolves this; both reporters confirmed deploys succeed against the updated backend. The fix was backend-side, so updating the CLI alone (1.29.3) did not help. Immediate workaround: pin convex to 1.29.1. Source: https://github.com/get-convex/convex-js/issues/105

When to use

You are seeing this: The situation: With convex 1.29.2 (and 1.29.3), convex deploy against a self-hosted backend fails with Error: Unable to start push to YOURTHEHOST loopback address:3210 / Error fetching POST YOURTHEHOST loopback address:3210/api/deploy2/evaluate\push 404 Not... Use this skill when you run into "convex deploy fails on 1.29.2/1.29.3 with 404 on /api/deploy2/evaluatepush (self-hosted backend)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: convex 1.29.2, 1.29.3, 1.29.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• YOURTHEHOST
• https://github.com/get-convex/convex-js/issues/105

Someone asked: With convex 1.29.2 (and 1.29.3), convex deploy against a self-hosted backend fails with Error: Unable to start push to YOUR_THE_HOST loopback address:3210 / Error fetching POST YOUR_THE_HOST loopback address:3210/api/deploy2/evaluate_push 404 Not Found. The identical command works with 1.29.1. The verified answer: Update your self-hosted backend , Convex shipped a new backend release that resolves this; both reporters confirmed deploys succeed against the updated backend. The fix was backend-side, so updating the CLI alone (1.29.3) did not help. Immediate workaround: pin convex to 1.29.1. Source: https://github.com/get-convex/convex-js/issues/105 Full thread: https://vectle.com/threads/thr_16noRGFsvTP9DSx3DQvsAQ

Not specified by the original author.

TL;DR

Strict is the default and is what production runs. If you need source span pointers for debugging raw combinator DSL nodes, set JULEPSOURCECAPTURE=1. Dev mode (deploy(..., mode=dev)) keeps compiling and running locally but retains the diagnostics strict prod would block on, so works in dev never means it deploys.

The error

Julep dev mode works but strict deploy fails

Fix

1. Strict is the default and is what production runs. Expected: You get the expected result; the problem is gone.

2. If you need source span pointers for debugging raw combinator DSL nodes, set JULEPSOURCECAPTURE=1. Expected: You get the expected result; the problem is gone.

3. Re-run the original operation and confirm the error is gone. Expected: no error, normal output.

When to use

• You hit this exact error.
• The symptom matches: Julep dev mode works but strict deploy fails.

When NOT to use

• A different error message; the cause here is specific to this error.
• Unrelated issues with a different cause.
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported per the linked source.

Variant phrasings

Julep dev mode works but strict deploy fails

Why it happens

My Julep flow works in dev mode but will not deploy to production. What is the difference between dev and strict mode?

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Source: My Julep flow works in dev mode but will not deploy to production. What is the difference between dev and strict mode?

Verified resolution: Strict is the default and is what production runs. Dev mode (deploy(..., mode=dev)) keeps compiling and running locally but retains the diagnostics strict prod would block on, so works in dev never means it deploys. Before shipping, call deployment.prodgapsummary() to see exactly what strict prod would reject, and clear that gap. Two more things that bite people: Temporal stays prod-strict, so Deployment.run(...) rejects dev-mode deployments outright, and Agent.deploy(...) uses the strict path. If you need source span pointers for debugging raw combinator DSL nodes, set JULEPSOURCECAPTURE=1.

Source URL: https://github.com/julep-ai/julep/blob/HEAD/docs-site/content/docs/guides/gotchas.md#dev-mode-vs-strict