chore: Refactor Docker setup — single multi-stage Dockerfile + AIO image

.github/workflows/docker-publish.yml

@@ -69,7 +69,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile
+          file: docker/Dockerfile
+          target: aio
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}

README.md

@@ -2,7 +2,6 @@
 
 Chadmin is an administration panel for ClickHouse — a real-time dashboard for monitoring running queries, managing users and access, and operating ClickHouse Cloud services. It auto-detects whether you're running a **single node**, a **self-hosted cluster**, or **ClickHouse Cloud**, and adapts the UI and SQL accordingly.
 
-
 ![Chadmin Dashboard](https://github.com/user-attachments/assets/a2541685-0b4b-433f-8cb0-3f72d6c7204f)
 
 ## Installation and Setup
@@ -54,24 +53,29 @@ docker run -d --name chadmin -p 8080:80 --env-file .env bun4uk/chadmin:latest
 ### Run via Docker Compose (development)
 
 #### Requirements
+
 - Docker and Docker Compose
 - Git
 
 #### Quick Start
 
 1. Clone the repository:
+
    ```bash
    git clone https://github.com/bun4uk/chadmin.git
    cd chadmin
    ```
 
 2. Create and configure the `.env` file:
+
    ```bash
    cp .env.example .env
    ```
+
    Edit `.env` and add your ClickHouse credentials. For ClickHouse Cloud, set `CLICKHOUSE_CLOUD_KEY_ID` and `CLICKHOUSE_CLOUD_KEY_SECRET` — Cloud mode turns on automatically when these are present. See `.env.example` for the full list.
 
 3. Launch the project:
+
    ```bash
    docker-compose up -d
    ```
@@ -102,18 +106,21 @@ docker-compose exec frontend npm run build        # one-shot production build
 ### Useful Commands
 
 #### Complete shutdown of the project
+
 ```bash
 docker-compose down
 ```
 
 #### Viewing logs
+
 ```bash
 docker-compose logs -f app
 docker-compose logs -f nginx
 docker-compose logs -f frontend
 ```
 
 #### Full restart with cache clearing
+
 ```bash
 docker-compose down
 rm -rf var/cache/* var/log/* public/build/*
@@ -141,4 +148,3 @@ docker-compose exec app bin/console cache:clear
 - Cloud-only: wake idle/stopped services from the UI; deep-link to a specific warehouse/service via URL params (`?warehouse=…&service=…`)
 - Light/dark theme toggle, persisted per browser
 - Polling pauses when the tab is hidden, so idle Cloud services aren't kept warm by a background tab
-

docker-compose.yml

@@ -1,54 +1,59 @@
 services:
   nginx:
-    build:
-      context: .
-      dockerfile: docker/dev/nginx/Dockerfile
+    image: nginxinc/nginx-unprivileged:1.31.0-alpine3.23-slim
+    user: "1984:1984"
     volumes:
-      - ./docker/dev/nginx/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf
+      - ./docker/configs/nginx.conf:/etc/nginx/nginx.conf
+      - ./docker/configs/nginx-chadmin.conf:/etc/nginx/conf.d/default.conf
       - .:/var/www/html
+      - php-sock:/sock
     ports:
       - "80:80"
     depends_on:
-      - app
+      - php-fpm
       - frontend
     env_file:
       - .env
     networks:
-      - sp-net
+      - docker-net
 
-  app:
+  php-fpm:
     build:
       context: .
-      dockerfile: docker/dev/php/Dockerfile
+      dockerfile: docker/Dockerfile
+      target: base
+    user: "1984:1984"
     volumes:
       - .:/var/www/html
+      - php-sock:/sock
     env_file:
       - .env
     networks:
-      - sp-net
+      - docker-net
 
   composer:
-    image: composer:latest
+    image: composer:2.9.8
+    user: "1984:1984"
     volumes:
       - .:/app
     working_dir: /app
-    command: ["composer"]
+    command: ["composer", "install", "--no-interaction", "--prefer-dist"]
     networks:
-      - sp-net
+      - docker-net
 
   frontend:
     image: node:24.15.0-alpine3.23
+    user: "1984:1984"
     volumes:
       - .:/app
     working_dir: /app
-    command: sh -c "npm install && npm run watch"
+    command: sh -c "npm install"
     networks:
-      - sp-net
-    deploy:
-      resources:
-        limits:
-          memory: 8G
+      - docker-net
+
+volumes:
+  php-sock:
 
 networks:
-  sp-net:
+  docker-net:
     driver: "bridge"

docker/Dockerfile

@@ -0,0 +1,83 @@
+FROM composer:2.9.8 AS vendor
+
+WORKDIR /app
+
+COPY composer.json composer.lock ./
+COPY bin/console bin/console
+
+# Composer image ships its own PHP, which may lag behind the runtime version below.
+# Skip the platform PHP check at install time — the runtime PHP is what executes the code.
+RUN composer install \
+      --no-scripts \
+      --no-dev \
+      --optimize-autoloader \
+      --no-progress \
+      --no-interaction \
+      --ignore-platform-req=php
+
+FROM node:24.15.0-alpine3.23 AS frontend
+
+RUN apk add --no-cache python3 make g++
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+# npm install (not `npm ci`) — the committed lock file has stale peer-dep entries
+# from earlier upstream packages; npm install reconciles silently, npm ci fails strict.
+RUN npm install --no-audit --no-fund --no-progress --legacy-peer-deps
+
+COPY frontend/ ./frontend/
+COPY assets/   ./assets/
+COPY public/   ./public/
+
+RUN npm run build
+
+# Target for base php-fpm mode
+FROM php:8.5.5-fpm-alpine3.23 AS base
+
+RUN (docker-php-ext-enable opcache || true)
+
+WORKDIR /var/www/html
+
+RUN addgroup -S chadmin && adduser --uid 1984 -S chadmin -G chadmin && \
+ mkdir -p /sock && chown chadmin:chadmin /sock && chmod 750 /sock
+
+# Application source + built artifacts
+COPY --chown=chadmin:chadmin . /var/www/html 
+COPY --from=frontend --chown=chadmin:chadmin /app/public/build /var/www/html/public/build
+COPY --from=vendor   --chown=chadmin:chadmin /app/vendor/      /var/www/html/vendor/
+
+COPY docker/configs/php-fpm.conf /usr/local/etc/php-fpm.d/www.conf
+
+USER chadmin
+
+CMD ["php-fpm", "-F"]
+
+
+# Target for all in one image mode
+FROM base AS aio
+
+USER root
+
+RUN apk add --no-cache \
+       nginx \
+       supervisor \
+       && rm -rf /var/cache/apk/* /tmp/*
+
+# Runtime configs
+COPY docker/configs/nginx.conf /etc/nginx/nginx.conf
+COPY docker/configs/nginx-chadmin.conf /etc/nginx/conf.d/default.conf
+COPY docker/configs/php-fpm.conf /usr/local/etc/php-fpm.d/www.conf
+COPY docker/configs/supervisord.conf /etc/supervisord.conf
+COPY docker/aio-entrypoint.sh /usr/local/bin/entrypoint.sh
+
+RUN chmod +x /usr/local/bin/entrypoint.sh \
+ && cp /var/www/html/.env.example /var/www/html/.env
+
+USER chadmin
+
+EXPOSE 80
+
+# Let's have some fun
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["supervisord", "-c", "/etc/supervisord.conf"]

docker/entrypoint.sh → docker/aio-entrypoint.sh

@@ -1,12 +1,6 @@
 #!/bin/sh
 set -e
 
-# Symfony writes cache і логи в /var/www/html/var — мусить існувати і бути writable
-# власником php-fpm worker'а (www-data).
-mkdir -p /var/www/html/var/cache /var/www/html/var/log
-chown -R www-data:www-data /var/www/html/var
-chmod -R u+rwX,g+rwX /var/www/html/var
-
 # Symfony вимагає непорожнє APP_SECRET. У проді користувач має передати своє через -e,
 # але щоб контейнер не падав без явно заданого значення, генеруємо випадкове fallback.
 if [ -z "${APP_SECRET:-}" ]; then
@@ -18,4 +12,4 @@ fi
 # Кеш Symfony білдиться лінivo на першому запиті — warmup тут навмисно не робимо,
 # щоб уникнути chown-перегонів між root-entrypoint'ом і www-data-php-fpm.
 
-exec "$@"
+exec "$@"

docker/dev/nginx/nginx/conf.d/default.conf → docker/configs/nginx-chadmin.conf

@@ -1,14 +1,13 @@
+upstream php_fpm {
+    server unix:/sock/fpm.sock;
+}
+
 server {
     listen 80;
     server_name _;
     root /var/www/html/public;
     index index.php index.html;
 
-    # Дозволяємо Nginx щоразу оновлювати DNS-запис сервісу `app`
-    resolver 127.0.0.11 ipv6=off;
-    # Змінна, щоб примусити повторну резолюцію при кожному запиті
-    set $php_backend "app:9000";
-
     # For serving embedded Symfony Encore resources
     location /build/ {
         try_files $uri =404;
@@ -25,7 +24,7 @@ server {
     }
 
     location ~ ^/index\.php(/|$) {
-        fastcgi_pass      $php_backend;
+        fastcgi_pass      php_fpm;
         fastcgi_split_path_info ^(.+\.php)(/.*)$;
         include fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;