tajniak81andClaude Opus 4.8
01d82ebda9
Audited every Dockerfile, compose file and .env.example against the code
they deploy. Four things had drifted:
Persistence. The API Server writes plugins.json and rewrites .env (the
panel's retarget-PocketBase flow) relative to its working directory,
which was a root-owned /app while the process runs as the app user - so
both writes failed, and no volume was declared to keep them anyway. The
binary moves to /usr/local/bin and the working directory becomes a /data
volume owned by app. The AIO image gets the same via directory=/data on
its supervisord program.
OCPP. Charger control was undeployable: OCPP_REQUIRE_TLS defaults to true
and appeared in no Docker file, so a charger dialling the plain-HTTP
/ocpp/{serial} was rejected with nothing explaining why. Both OCPP vars
are now threaded through the compose files and env examples, with the
reasoning (the per-charger control token rides in a Basic-auth header).
CORS. API Server/docker-compose.yml defaulted to localhost:5173, the Vite
dev port, where every other file uses 8090.
Env names. .env.example has called PB_URL/PB_ADMIN_*/PORT legacy for a
while, but the Docker layer still used them. Container-side names are now
POCKETBASE_*/API_ADDR; the .env keys operators set stay PB_ADMIN_* so
existing .env files keep working.
Left alone deliberately: alpine:latest stays unpinned (cannot verify
current tags or test the build from here), and the golang/node bases
already match go.mod and Vite 8's floor.
Validated as YAML only - there is no Docker CLI on this machine, so no
image was built and the /data ownership fix follows standard volume
semantics rather than an observed run.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
1.9 KiB
Docker
51 lines
1.9 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# --- Build stage -------------------------------------------------------------
|
|
# Compile a static Go binary. The Vue panel is pre-built into internal/api/dist
|
|
# and embedded via //go:embed, so no Node toolchain is needed here.
|
|
FROM golang:1.26-alpine AS build
|
|
|
|
WORKDIR /src
|
|
|
|
# Cache module downloads separately from the source for faster rebuilds.
|
|
COPY go.mod ./
|
|
# go.sum is optional (stdlib-only module today); copy it if present.
|
|
COPY go.su[m] ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
# CGO_ENABLED=0 produces a static binary that runs on a bare alpine image. The
|
|
# entry point is the cmd/server package.
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api-server ./cmd/server
|
|
|
|
# --- Runtime stage -----------------------------------------------------------
|
|
FROM alpine:latest
|
|
|
|
# HTTPS calls to PocketBase need CA certificates; tzdata for correct timestamps.
|
|
RUN apk add --no-cache ca-certificates tzdata
|
|
|
|
# Run as an unprivileged user.
|
|
RUN addgroup -S app && adduser -S -G app app
|
|
|
|
COPY --from=build /out/api-server /usr/local/bin/api-server
|
|
|
|
# The server writes two files relative to its working directory: plugins.json
|
|
# (plugin enable-state + config) and .env, which the panel rewrites when a
|
|
# superadmin retargets the PocketBase connection. Both must therefore live on a
|
|
# writable, persistent path — hence /data, owned by the unprivileged user and
|
|
# declared as a volume. A named volume mounted here inherits this ownership.
|
|
RUN mkdir -p /data && chown app:app /data
|
|
WORKDIR /data
|
|
VOLUME /data
|
|
|
|
# Config comes entirely from environment variables (see .env.example).
|
|
# POCKETBASE_ADMIN_EMAIL / _PASSWORD are optional at startup: without them the
|
|
# server still runs and a superadmin can configure the connection from the panel.
|
|
ENV API_ADDR=:8080 \
|
|
PLUGINS_FILE=/data/plugins.json
|
|
EXPOSE 8080
|
|
|
|
USER app
|
|
ENTRYPOINT ["/usr/local/bin/api-server"]
|