codingetandClaude
ec6c4e8df0
node:24-bookworm-slim image with git for the read-only vault endpoints, non-root user with system-wide git safe.directory (mounted vaults are usually owned by a host uid), /config + /data + /vaults mount conventions baked in via BRAINDUMP_CONFIG/BRAINDUMP_DB, and an /api/health healthcheck. README gains a Deployment section (mounts, claude-sdk skill/auth requirements in-container, compose example, reverse-proxy SSE buffering notes). dbPath in the config file now defaults to ./braindump.sqlite instead of being required — it was validated before the BRAINDUMP_DB env override was applied, so the image's baked-in db path couldn't rescue a config that omitted it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
35 lines
1.1 KiB
Docker
35 lines
1.1 KiB
Docker
FROM node:24-bookworm-slim
|
|
|
|
# git is needed for the read-only /git/status and /git/diff endpoints
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
|
|
COPY tsconfig.json config.example.jsonc ./
|
|
COPY src ./src
|
|
COPY scripts ./scripts
|
|
|
|
# Non-root user. Mounted vaults are usually owned by a host uid that doesn't
|
|
# match the container user, which git refuses to touch by default — allow it
|
|
# system-wide (read-only endpoints only; braindump never commits).
|
|
RUN useradd -m braindump \
|
|
&& git config --system --add safe.directory '*' \
|
|
&& mkdir -p /data /config /vaults \
|
|
&& chown braindump /data
|
|
|
|
USER braindump
|
|
ENV BRAINDUMP_CONFIG=/config/config.jsonc \
|
|
BRAINDUMP_DB=/data/braindump.sqlite \
|
|
NODE_ENV=production
|
|
|
|
EXPOSE 3000
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
|
|
CMD node -e "fetch('http://localhost:'+(process.env.PORT||3000)+'/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
|
|
CMD ["npx", "tsx", "src/bin/braindump-web.ts"]
|