PocketBase as a standalone database server

The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).

Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.

Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker-AIO/Dockerfile.PocketBase

@@ -1,7 +1,8 @@
 # warp-aio-pocketbase — the homeserver, the admin panel and the web client
-# in one image, on PocketBase. PocketBase is the homeserver's embedded
-# database driver: its data directory, with media in its storage, is
-# /data/pb_data. Set WARP_PB_S3_* to keep media in an S3 bucket instead.
+# in one image, on PocketBase. PocketBase runs as a process of its own in
+# the container, on port 8070, with its pb_data — the database, and media
+# in its storage — in /data/pb_data. Set WARP_PB_S3_* to keep media in an
+# S3 bucket instead.
 #
 # Build from the repository root:
 #
@@ -11,6 +12,10 @@
 #
 # The database, signing key and media live in /data; mount a volume on it.
 
+# PocketBase itself: the binary of this image, PocketBase 0.40 or later.
+ARG PB_IMAGE=tajniak81/pocketbase-docker-root:latest
+FROM ${PB_IMAGE} AS pocketbase
+
 FROM node:22-alpine AS web
 
 WORKDIR /src
@@ -74,6 +79,8 @@ RUN apk add --no-cache ca-certificates tzdata curl tini && \
     adduser -D -u 10001 -h /data warp
 
 COPY --from=build /out/warp /out/warp-admin /out/warp-web /usr/local/bin/
+# PocketBase, from the same image the separate-container stacks run.
+COPY --from=pocketbase /pb/pocketbase /usr/local/bin/pocketbase
 COPY warp.yaml.example /etc/warp/warp.yaml.example
 COPY --chmod=755 Docker-AIO/entrypoint.sh /usr/local/bin/warp-aio
 
@@ -85,7 +92,7 @@ USER warp
 ENV WARP_LISTEN_ADDRESS=":8008" \
     WARP_PRIVATE_KEY="/data/signing.key" \
     WARP_DB_DRIVER="pocketbase" \
-    WARP_DB_CONNECTION_STRING="/data/pb_data" \
+    WARP_DB_CONNECTION_STRING="http://127.0.0.1:8070" \
     WARP_LOG_FORMAT="json" \
     WARP_ADMIN_LISTEN=":8009" \
     WARP_ADMIN_HOMESERVER="http://127.0.0.1:8008" \
@@ -95,9 +102,11 @@ ENV WARP_LISTEN_ADDRESS=":8008" \
     WARP_WEB_LOG_FORMAT="json" \
     WARP_AIO_ADMIN="true" \
     WARP_AIO_WEB="true" \
+    WARP_AIO_POCKETBASE="true" \
+    WARP_PB_SUPERUSER_FILE="/data/pocketbase-superuser.env" \
     WARP_AIO_EMBEDDED_POSTGRES="false"
 
-EXPOSE 8008 8009 8080
+EXPOSE 8008 8009 8080 8070
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
     CMD curl -fsS http://127.0.0.1:8008/healthz && \