feat: add container manager CLI commands and docker-compose overlay for admin container lifecycle

2026-06-09 04:41:27 +00:00
parent 317126efc2
commit c565e3b55c
83 changed files with 6078 additions and 84 deletions
@@ -0,0 +1,41 @@
+# Opt-in overlay that enables the admin-only Container Manager.
+#
+# Preferred:  make docker-build && make docker-up
+#   The Makefile applies this overlay, derives DOCKER_GID from the socket, and
+#   points DEVPLACE_DATA_DIR at the project's own var/ at its real host path, so
+#   everything below resolves with no extra setup.
+#
+# Manual:  docker compose -f docker-compose.yml -f docker-compose.containers.yml up -d --build
+#   Then set DOCKER_GID in .env and, if you want the documented /srv default,
+#   create it first:  sudo mkdir -p /srv/devplace-data && sudo chown 1000:1000 /srv/devplace-data
+#
+# SECURITY: mounting the docker socket grants the app container root on the host.
+# Only enable this if you trust your administrators; every build/run/exec is admin-only.
+#
+# DooD bind-mount gotcha: when the app (inside its container) runs `docker run -v
+# <path>:/app`, the docker DAEMON resolves <path> against the HOST filesystem, not the
+# app container. So the data dir must be mounted at the SAME absolute path on the host
+# and in the app container - that is why DEVPLACE_DATA_DIR and the volume below use one
+# identical path on both sides.
+#
+# Ingress (/p/<slug>) proxies to published container ports on the HOST, so the app
+# reaches them via host.docker.internal (mapped to the host gateway below).
+
+services:
+  app:
+    build:
+      args:
+        INSTALL_DOCKER_CLI: "true"
+    environment:
+      DEVPLACE_DATA_DIR: ${DEVPLACE_DATA_DIR:-/srv/devplace-data}
+      DEVPLACE_CONTAINER_PROXY_HOST: host.docker.internal
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    # The app runs as UID 1000; add the host docker group so it can use the socket.
+    # `make docker-up` derives DOCKER_GID from the socket itself; set it in .env
+    # only for a manual `docker compose` invocation.
+    group_add:
+      - "${DOCKER_GID:-999}"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${DEVPLACE_DATA_DIR:-/srv/devplace-data}:${DEVPLACE_DATA_DIR:-/srv/devplace-data}