Cannot upload reports when running locally

I have Codecov running locally and was able to login with Github. When configuring a repo, I chose "Using Codecov's CLI" as a setup option. The instructions specify to run ./codecov -u http://localhost:8080 upload-process (which I think may be outdated since the GHA uses upload-coverage 🤷 ). After collecting coverage data and exporting CODECOV_TOKEN, I run the preceding command and see the following error message:

Exception: Request failed after too many retries. URL: http://minio:9000/archive/v4/raw/2025-04-02/1368DA4AB2901AD7D7C96EF7A5329605/d26ae56308d720deb859480200c53aedceb07b3d/df383e68-1e7f-4efb-8540-a80cbfc3b87b/20416e62-3341-4a48-9a97-1dab323755af.txt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=codecov-default-key%2F20250402%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250402T222310Z&X-Amz-Expires=10&X-Amz-SignedHeaders=host&X-Amz-Signature=cee1e12891f475b8ccf3c99b248112787350cb2bd1a98f99cedffc75a6d372a5

Note that this is after a successful call to the API's /upload endpoint.

Clearly, the issue is that the url is http://minio:9000 as specified in the codecov.yml file (which I will include below). If I change the minio host to localhost:9000 then /upload endpoint fails because the serializer is trying to create a presigned put url. That calls this method on the archive service, which always uses minio, and in this case we actually want the host to be minio since we are in the docker network.

Does anyone have a workaround? The only thing I can think of is running the CLI in the same docker network as the rest of the app. The command could perhaps then be ./codecov -u http://gateway upload-process.

For reference, the config/codecov.yml file looks like:

setup:
  # Replace with the http location of your Codecov
  # https://docs.codecov.io/docs/configuration#section-codecov-url
  codecov_url: http://localhost:8080
  #codecov_api_url: <codecov-url> # this defaults to <codecov-url> and is designed to work out of the box like this
  #api_allowed_hosts: [] # this defaults to <codecov-url> and is designed to work out of the box like this
  # Replace with your Codecov Enterprise License key. This is required for the containers to function.
  # https://docs.codecov.io/docs/configuration#section-enterprise-license
  enterprise_license: "F5O0Fu5ASFTPtWXM51BK8YQlq7IM2s+8TBGULrf9Um7wHjfPwI+Z3E4PfF/dPs6Uc5A+MLti+2etHq5dnFEfZgoiIVCLZ8x+0BVmUSWwPS42vJXnf1veY9Bglang4mDIhmfWfp5l6AT6cxmAVFpGrwobiK6OcN9pjWx4iWabazmsOiF9LM++v0WtuHNvhgzRcKmnJPgqahEB7qqF6KQ1hg=="
  # https://docs.codecov.com/docs/configuration#instance-wide-admins
  admins:
    - service: github
      username: "<your-user>"
  # Replace with a random string
  # https://docs.codecov.io/docs/configuration#section-cookie-secret
  http:
    cookie_secret: "cookiesecret"
    cookies_domain: localhost
  timeseries:
    enabled: true
github:
  client_id: "<my client id>"
  client_secret: "<my client secret>"
  global_upload_token: "<upload-token>"
services:
  redis_url: "redis://redis:6379"
  database_url: "postgres://postgres:testpassword@postgres:5432/postgres"
  timeseries_database_url: "postgres://postgres:testpassword@timescale:5432/postgres"
  minio:
    host: minio
    port: 9000
    auto_create_bucket: true
# If using external storage. Comment above and uncomment below
#    host: s3.amazonaws.com or storage.googleapis.com if using GCS
#    bucket: <bucket-name>
#    region: <bucket-region>
#    verify_ssl: true
#    port: 443
#    access_key_id: <aws-iam-access-key> # or <gcs-hmac-key> if using GCS
#    secret_access_key: <aws-iam-secret> # or <gcs-hmac-secret> if using GCS
#    iam_auth: <boolean, default false> # set to true in AWS to attempt to authenticate via Instance role

Thank you!

Start with config/codecov.yml and the upload-process CLI path, then inspect upload/serializers.py at the presigned URL creation and shared/api_archive/archive.py around lines 173-174. Reproduce the local Docker Compose upload and trace the successful /upload response through the subsequent archive request. Done means local CLI uploads complete while the API and MinIO endpoints remain reachable in their respective network contexts.