valknar
0140960df6
Multi-stage Dockerfile (deps -> build -> prod-deps -> runtime) that ships a full production node_modules rather than Next's standalone output, since standalone tracing is incompatible with a custom server (noted back in M1). Runs as a non-root user with a read-only rootfs, dropped capabilities, and tini as PID 1. tsx moves from dev to a real runtime dependency since the production start script runs server.ts directly rather than a precompiled bundle. next.config.ts marks dockerode/systeminformation as serverExternalPackages so Next's bundler leaves their OS-conditional requires alone. docker-compose.yml mirrors the sibling stacks' own conventions (TRAEFIK_HOST/NETWORK_NAME in .env, falcon_network as an external network, the same traefik.* label shape) so it fits their existing tooling, plus a new /api/health route and healthcheck.mjs for the container HEALTHCHECK. Verified end-to-end with a real `docker build` + `docker compose up`: non-root/read-only/cap-dropped container boots cleanly, is reachable by container name from another container on the shared network (as Traefik would reach it), and the container's own HEALTHCHECK reports healthy. That run surfaced a real gap - the non-root user got EACCES on /var/run/docker.sock, since it's owned by root:docker on the host - fixed via group_add on a DOCKER_GID env var (documented in .env.example with the command to find it), then re-verified that both docker.sock access and label-based auto-discovery work correctly under the fix.
53 lines
2.0 KiB
YAML
53 lines
2.0 KiB
YAML
services:
|
|
pulsenode:
|
|
build: .
|
|
container_name: pulsenode
|
|
restart: unless-stopped
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
- /app/.next/cache
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
# The container runs as a non-root user, but /var/run/docker.sock is
|
|
# owned by root:docker on the host - without joining that GID the
|
|
# container gets EACCES connecting to it. Set DOCKER_GID in .env to
|
|
# your host's docker group id (`getent group docker | cut -d: -f3`).
|
|
group_add:
|
|
- "${DOCKER_GID}"
|
|
volumes:
|
|
# Read-only: PulseNode only inspects/lists containers and reads stats,
|
|
# never execs into or writes to them.
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- ./config:/app/config:ro
|
|
env_file: .env
|
|
networks:
|
|
- falcon_network
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=${NETWORK_NAME}
|
|
- traefik.http.middlewares.pulsenode-redirect-web-secure.redirectscheme.scheme=https
|
|
- traefik.http.routers.pulsenode-web.rule=Host(`${TRAEFIK_HOST}`)
|
|
- traefik.http.routers.pulsenode-web.entrypoints=web
|
|
- traefik.http.routers.pulsenode-web.middlewares=pulsenode-redirect-web-secure
|
|
- traefik.http.routers.pulsenode-web-secure.rule=Host(`${TRAEFIK_HOST}`)
|
|
- traefik.http.routers.pulsenode-web-secure.entrypoints=websecure
|
|
- traefik.http.routers.pulsenode-web-secure.tls.certresolver=resolver
|
|
# Verify these entrypoint/middleware/certresolver names against
|
|
# traefik/dynamic/*.yaml in the stacks repo before deploying - written
|
|
# to match that repo's own convention, not independently confirmed.
|
|
- traefik.http.routers.pulsenode-web-secure.middlewares=security-headers@file,no-index@file
|
|
- traefik.http.services.pulsenode-web-secure.loadbalancer.server.port=3000
|
|
healthcheck:
|
|
test: ["CMD", "node", "healthcheck.mjs"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
start_period: 15s
|
|
retries: 3
|
|
|
|
networks:
|
|
falcon_network:
|
|
external: true
|