LobotomyLabs/dumpsterChat
2
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 10 Wiki Activity

ops: .dockerignore, non-root user, network isolation, deploy rollback

Browse Source 
- .dockerignore excludes .git, node_modules, certs, *.zip
- Dockerfile runs as non-root appuser
- compose.yml isolates frontend (Caddy only) and backend (DB/cache/media) networks
- deploy.sh snapshots binary before pull and rolls back on failed health check
This commit is contained in:
Dustin Newkirk
2026-07-20 13:15:19 -04:00
parent 1d6c9bdfe6
commit 44370f41e5
4 changed files with 55 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/Dockerfile
+3 -1
View File
@@ -16,8 +16,10 @@ RUN npm run build
FROM alpine:latest
RUN apk --no-cache add ca-certificates
RUN adduser -D -g '' appuser
WORKDIR /app
COPY --from=go-builder /bin/dumpster-server /app/dumpster-server
COPY --from=web-builder /app/dist /srv/web
USER appuser
EXPOSE 8080
CMD ["sh", "-c", "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"]
CMD sh -c "if [ -z \"$DUMPSTER_SECRET\" ]; then export DUMPSTER_SECRET=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 32); fi; /app/dumpster-server"