Container Deployment

Container deployment

The repository contains a multi-stage Dockerfile and a hardened compose.yaml. The source target builds phoenix with the stable Rust toolchain from the locked Cargo graph, then copies the release binary into a scratch runtime image.

The container runs as uid and gid 65532. State lives under /data, agent files live under /workspace, and the root filesystem can remain read-only. Provide credentials as protected environment variables or through the mounted state location. Never add them to an image layer or repository file.

docker compose build
docker compose up -d
docker compose logs -f phoenix

The included Compose service builds the local source target, drops every Linux capability, enables no-new-privileges, uses a read-only root filesystem, provides a bounded /tmp, persists state and workspace in named volumes, and publishes port 8787 only on 127.0.0.1.

To use HTTP inside the container, configure [http] with bind = "0.0.0.0", set a bearer token, and keep the host mapping on loopback unless deliberate remote access is required. The web UI also requires a username and password.

compose.yaml names ghcr.io/paulus1337/openphoenix:v0.0.1. The default build is local and does not depend on pulling that tag. Verify the running binary with docker compose exec phoenix --version, then test phoenix doctor and the /health route.

See Configuration, Web-UI, and Security.