driver-vault/DriverVault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docker: a build context that isn't 3.6GB, and health you can see

Browse Source 
The all-in-one image builds from the project root, and Docker only reads
.dockerignore from the context root — so the ones under "API Server" and
"Web App" never applied to it and every AIO build shipped the whole tree,
"Phone App/build" included. A root .dockerignore allow-lists the paths that
build actually copies.

The dev split stack passed neither PB_BOOTSTRAP nor the SUPERADMIN vars, so
it created the schema and then no user to log in with. It passes them now,
and .env.example says so.

WEBAPP_URL was never set anywhere, leaving the panel status page probing
localhost:8090 — itself — and always reporting the Web App as down. Each
compose file now points it at wherever the Web App really is, and the BFF
grew a real /healthz instead of letting the SPA fallback answer probes with
index.html and look healthy no matter what.

In the AIO, PocketBase and the API Server drop to an unprivileged user;
only nginx stays root to bind :80. The entrypoint takes ownership of the
two volumes first, so data written by the old root-only image stays
writable. All three images carry a HEALTHCHECK, every compose file declares
one too (so depends_on still gates against an older pulled image), and
web-app waits for the API Server to be serving rather than merely started.

Also: pinned alpine/golang/node and PocketBase 0.39.11, so a rebuild months
from now produces the same image; nginx forwards WebSocket upgrades instead
of stripping them, with the map in http.d where Alpine actually reads it;
and a .gitattributes keeps entrypoint.sh on LF, because a CRLF shebang from
a Windows clone fails at container start with "no such file or directory".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tajniak81
2026-08-20 17:07:52 +02:00
co-authored by Claude Opus 5
parent 9487de84b0
commit f08849e50c
16 changed files with 284 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Docker-AIO/.env.example
+4 -2
View File
@@ -37,5 +37,7 @@ API_PORT=8080
# --- Build args (optional) ---------------------------------------------------
# Leave empty so the browser uses same-origin /api (proxied by nginx).
VITE_API_BASE=
# Pin a PocketBase version, or leave empty to fetch the latest at build time.
PB_VERSION=
# PocketBase version. The Dockerfile already pins one; set this only to build a
# different version. Leaving it commented out keeps the pin (an empty value here
# is passed through as-is and would resolve the latest release at build time).
#PB_VERSION=0.39.11
Docker-AIO/Dockerfile
+79 -13
View File
@@ -3,7 +3,8 @@
# All-in-one image: PocketBase + API Server + Web App in a single container.
#
# The build context MUST be the project root so this file can reach both
# "API Server/" and "Web App/". Build it with:
# "API Server/" and "Web App/". The root .dockerignore is an allow-list of the
# paths copied below — add to it if you add a COPY here. Build it with:
#
# docker build -f "Docker-AIO/Dockerfile" -t drivervault-aio .
#
@@ -22,7 +23,7 @@
# On first boot the API Server creates the collections and the super-admin.
# --- Stage 1: build the Go API Server ---------------------------------------
FROM golang:1.26-alpine AS api-build
FROM golang:1.26-alpine3.24 AS api-build
WORKDIR /src
COPY ["API Server/go.mod", "./"]
COPY ["API Server/go.su[m]", "./"]
@@ -35,7 +36,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api-ser
# --- Stage 2: build the Vue Web App -----------------------------------------
# The Vue source lives under "Web App/web/".
FROM node:22-alpine AS web-build
FROM node:22-alpine3.24 AS web-build
WORKDIR /app
COPY ["Web App/web/package.json", "Web App/web/package-lock.json", "./"]
RUN npm ci
@@ -48,14 +49,23 @@ ARG VITE_API_BASE
RUN npm run build -- --outDir dist --emptyOutDir
# --- Stage 3: runtime (all services) ----------------------------------------
FROM alpine:latest
FROM alpine:3.24
ARG PB_VERSION=""
# Pinned so a rebuild months from now produces the same PocketBase. Override to
# upgrade (--build-arg PB_VERSION=0.40.0); set it to empty to resolve the latest
# release at build time, which needs an unauthenticated GitHub API call and is
# therefore subject to that GitHub rate limit (60/hour per IP).
ARG PB_VERSION="0.39.11"
# Provided automatically by BuildKit (amd64 / arm64).
ARG TARGETARCH="amd64"
RUN apk add --no-cache ca-certificates tzdata unzip wget nginx supervisor \
&& mkdir -p /run/nginx
# Unprivileged account for PocketBase and the API Server. Only nginx stays root,
# because it binds port 80; supervisord drops to this user for the other two.
RUN addgroup -S app && adduser -S -G app app
# PocketBase from the official release (pinned via PB_VERSION, else latest).
WORKDIR /pb
RUN set -eux; \
@@ -74,6 +84,17 @@ RUN set -eux; \
COPY --from=api-build /out/api-server /usr/local/bin/api-server
COPY --from=web-build /app/dist /usr/share/nginx/html
# WebSocket handshakes need Connection/Upgrade forwarded, and the map deriving
# them must sit in the http context, not inside a server block. It goes in
# http.d/ (which Alpine nginx includes from http{}; it does not read conf.d/),
# and the 00- prefix keeps it ahead of default.conf in the include order.
RUN cat > /etc/nginx/http.d/00-upgrade.conf <<'NGINXMAP'
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
NGINXMAP
# nginx: serve the SPA and proxy /api/ to the API Server on localhost.
RUN cat > /etc/nginx/http.d/default.conf <<'NGINX'
server {
@@ -86,9 +107,20 @@ server {
gzip_types text/plain text/css application/javascript application/json image/svg+xml;
gzip_min_length 1024;
# A real liveness route, so the SPA fallback below cannot answer a health
# probe with index.html and make a broken container look healthy.
location = /healthz {
access_log off;
add_header Content-Type text/plain;
return 200 "ok";
}
location /api/ {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
# Forward WebSocket upgrades instead of silently stripping them.
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -116,9 +148,11 @@ pidfile=/run/supervisord.pid
logfile=/dev/null
logfile_maxbytes=0
; PocketBase: upsert the superuser (idempotent) then serve.
; PocketBase: upsert the superuser (idempotent) then serve. Runs as the
; unprivileged app user, which owns /pb and the pb_data volume.
[program:pocketbase]
directory=/pb
user=app
command=/bin/sh -c '/pb/pocketbase superuser upsert "$PB_ADMIN_EMAIL" "$PB_ADMIN_PASSWORD" 2>/dev/null || true; exec /pb/pocketbase serve --http=0.0.0.0:8070'
priority=10
autostart=true
@@ -129,10 +163,11 @@ stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
; API Server: wait for PocketBase to be healthy, then start. It runs from /data
; because it writes plugins.json and the panel's .env relative to its working
; because it writes plugins.json and the panel .env relative to its working
; directory, and /data is the volume that keeps them across container recreates.
[program:api-server]
directory=/data
user=app
command=/bin/sh -c 'until wget -qO- http://127.0.0.1:8070/api/health >/dev/null 2>&1; do echo "waiting for pocketbase..."; sleep 1; done; exec /usr/local/bin/api-server'
priority=20
autostart=true
@@ -142,6 +177,7 @@ stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
; nginx stays root so it can bind :80; its own workers drop to the nginx user.
[program:nginx]
command=/usr/sbin/nginx -g 'daemon off;'
priority=30
@@ -153,12 +189,32 @@ stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
SUPERVISOR
# API Server config: everything is local to this container.
# The entrypoint stays root only long enough to make the two volumes writable by
# the app user, then hands off to supervisord. The chown matters for volumes
# created by an earlier build of this image, when both services ran as root.
RUN cat > /entrypoint.sh <<'ENTRY'
#!/bin/sh
set -e
for dir in /pb/pb_data /data; do
mkdir -p "$dir"
if [ "$(stat -c %U "$dir" 2>/dev/null)" != "app" ]; then
echo "entrypoint: taking ownership of $dir"
chown -R app:app "$dir"
fi
done
exec supervisord -c /etc/supervisord.conf
ENTRY
RUN chmod +x /entrypoint.sh
# API Server config: everything is local to this container. WEBAPP_URL is what
# the panel status page probes; nginx serves the Web App on :80 in here, so the
# stock default of localhost:8090 would always report the Web App as down.
ENV API_ADDR=:8080 \
POCKETBASE_URL=http://127.0.0.1:8070 \
CORS_ALLOW_ORIGINS=http://localhost:8090 \
AUTH_USERS_COLLECTION=users \
PLUGINS_FILE=/data/plugins.json
PLUGINS_FILE=/data/plugins.json \
WEBAPP_URL=http://127.0.0.1:80
# Required at runtime (no safe defaults): PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD.
# Optional: DRIVERVAULT_SUPERADMIN_EMAIL / DRIVERVAULT_SUPERADMIN_PASSWORD create
@@ -169,13 +225,23 @@ ENV API_ADDR=:8080 \
# base, or set OCPP_REQUIRE_TLS=false on a trusted network.
# Pass them with `docker run -e ...`.
RUN mkdir -p /data
# pb_data holds the database; /data holds the API Server's plugins.json and the
# .env the panel rewrites when a superadmin retargets PocketBase.
# pb_data holds the database; /data holds the API Server plugins.json and the
# .env the panel rewrites when a superadmin retargets PocketBase. Both are
# pre-created and owned by app so a fresh named volume inherits that ownership.
RUN mkdir -p /pb/pb_data /data && chown -R app:app /pb /data
VOLUME /pb/pb_data
VOLUME /data
# 80 = Web App, 8070 = PocketBase admin, 8080 = API Server + embedded API panel
# (also the /ocpp/{serial} endpoint chargers dial into).
EXPOSE 80 8070 8080
CMD ["supervisord", "-c", "/etc/supervisord.conf"]
# All three processes must answer, so a wedged component shows up in `docker ps`
# instead of a container that looks up while half of it is dead. start-period
# covers the first-boot schema bootstrap on a cold database.
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
CMD wget -qO- http://127.0.0.1:8070/api/health >/dev/null 2>&1 \
&& wget -qO- http://127.0.0.1:8080/healthz >/dev/null 2>&1 \
&& wget -qO- http://127.0.0.1:80/healthz >/dev/null 2>&1 \
|| exit 1
ENTRYPOINT ["/entrypoint.sh"]
Docker-AIO/README.md
+12 -7
View File
@@ -51,8 +51,9 @@ docker build -f "Docker-AIO/Dockerfile" -t drivervault-aio .
```
Build args: `VITE_API_BASE` (leave empty so the bundle uses same-origin `/api`)
and `PB_VERSION` (pin PocketBase, or leave empty to fetch the latest release at
build time).
and `PB_VERSION`, which the Dockerfile already pins. Override it to build a
different PocketBase; set it to an empty string to resolve the latest release at
build time instead.
## First boot
@@ -87,10 +88,14 @@ of it, with `OCPP_PUBLIC_URL` set to the public `wss://` base. Only drop
## Caveats
- Everything runs as **root** in one container, and a crash of `supervisord`
takes all three services down together. That is the trade for the simplicity.
- PocketBase and the API Server run as the unprivileged `app` user; only nginx
stays root, because it binds port 80. A crash of `supervisord` still takes all
three services down together — that is the trade for the simplicity.
- Logs from all three processes are interleaved on the container's stdout/stderr
(`docker logs drivervault-aio`).
- `PB_VERSION` empty means the image pulls whatever PocketBase release is latest
**at build time**, so two builds of the same source can differ. Pin it for
reproducibility.
- `PB_VERSION` is pinned in the Dockerfile so two builds of the same source
agree. Setting it to an empty string restores the old behaviour of resolving
the latest release **at build time**, which also costs an unauthenticated
GitHub API call and is subject to that 60/hour per-IP rate limit.
- The container reports health once all three processes answer their probes, so
a wedged component shows up in `docker ps` rather than looking up.
Docker-AIO/docker-compose.prod.yml
+11
View File
@@ -23,6 +23,9 @@ services:
PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD:?set PB_ADMIN_PASSWORD in .env}"
# Match CORS to the web origin (only used if a browser calls the API directly).
CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
# Probed by the panel status page. nginx serves the Web App on port 80
# inside this container, so the default (localhost:8090) would never answer.
WEBAPP_URL: "http://127.0.0.1:80"
# Schema + super-admin bootstrap on boot (idempotent). Set PB_BOOTSTRAP=false
# to skip once the database is established.
PB_BOOTSTRAP: "${PB_BOOTSTRAP:-true}"
@@ -45,6 +48,14 @@ services:
- "${PB_DATA:-pb_data}:/pb/pb_data"
# plugins.json + the .env the panel writes back.
- "${API_DATA:-api_data}:/data"
healthcheck:
# All three processes must answer. Declared here as well as in the image so
# the check is visible, and works against an older pulled image.
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null && wget -qO- http://127.0.0.1:8080/healthz >/dev/null && wget -qO- http://127.0.0.1:80/healthz >/dev/null || exit 1"]
interval: 30s
timeout: 5s
retries: 3
start_period: 60s
volumes:
pb_data:
Docker-AIO/docker-compose.yml
+16 -3
View File
@@ -12,9 +12,11 @@ services:
dockerfile: Docker-AIO/Dockerfile
args:
# Empty -> bundle uses same-origin "/api", proxied internally by nginx.
VITE_API_BASE: "${VITE_API_BASE:-}"
# Optional: pin PocketBase; empty fetches the latest release at build.
PB_VERSION: "${PB_VERSION:-}"
- VITE_API_BASE=${VITE_API_BASE:-}
# Bare name = pass through only when set in the environment, so an unset
# PB_VERSION leaves the Dockerfile pin in place instead of overriding it
# with an empty string (which would resolve "latest" at build time).
- PB_VERSION
image: drivervault-aio
container_name: drivervault-aio
restart: unless-stopped
@@ -24,6 +26,9 @@ services:
PB_ADMIN_PASSWORD: "${PB_ADMIN_PASSWORD:?set PB_ADMIN_PASSWORD in .env}"
# Match CORS to the web origin (only used if a browser calls the API directly).
CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
# Probed by the panel status page. nginx serves the Web App on port 80
# inside this container, so the default (localhost:8090) would never answer.
WEBAPP_URL: "http://127.0.0.1:80"
# Schema + super-admin bootstrap on boot (idempotent). Set PB_BOOTSTRAP=false
# to skip once the database is established.
PB_BOOTSTRAP: "${PB_BOOTSTRAP:-true}"
@@ -44,6 +49,14 @@ services:
- pb_data:/pb/pb_data
# plugins.json + the .env the panel writes back.
- api_data:/data
healthcheck:
# All three processes must answer. Declared here as well as in the image so
# the check is visible, and works against an older pulled image.
test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null && wget -qO- http://127.0.0.1:8080/healthz >/dev/null && wget -qO- http://127.0.0.1:80/healthz >/dev/null || exit 1"]
interval: 30s
timeout: 5s
retries: 3
start_period: 60s
volumes:
pb_data: