Oracle Container Images

Oracle Container Images

This page covers the Oracle Autonomous Database (ADB) variant of the TMI server container image (Dockerfile.server-oracle). Oracle ADB is a fully supported database backend; OCI itself is no longer a supported deployment target (see Terraform-Deployment for AWS and Local-Development-Cluster for local clusters).

Overview

Property	Value
Dockerfile	Dockerfile.server-oracle
Base	Oracle Linux 9 (builder), Oracle Linux 9-slim (runtime)
Database driver	godror via Oracle Instant Client 23ai (CGO, built with -tags oracle)
Runtime user	non-root tmi
Port	8080
Wallet mount	/wallet (read-only mount; wallet.zip is extracted at startup)

The image is selected automatically by the build script when --db-backend oracle-adb is used. The Redis image is not Oracle-specific; it is built from Dockerfile.redis.

Building

Container builds are managed by scripts/build-app-containers.py:

# Server image with Oracle ADB support, built locally
uv run scripts/build-app-containers.py --target local --db-backend oracle-adb --component server

# Same, with Grype vulnerability scan and Syft SBOM
uv run scripts/build-app-containers.py --target local --db-backend oracle-adb --component server --scan

Options: --target is local or aws; --component is server, redis, extractor, chunkembed, controller, or all; --arch is arm64, amd64, or both; --db-backend is postgresql (default) or oracle-adb; plus --registry, --push, --scan, --scan-only, and --no-cache. Multi-arch (--arch both) builds require --push.

Related Make targets: build-app, build-app-scan, build-app-aws, build-server-container, build-redis-container, build-all, and scan-containers. These use the default PostgreSQL backend; use the script directly for the Oracle variant.

Environment Variables

Variable	Required	Description
TMI_DATABASE_URL	Yes	e.g. oracle://user:password@tns_alias
TMI_ORACLE_WALLET_LOCATION	No	Set automatically by the entrypoint to /tmp/wallet after extraction
TMI_REDIS_URL	Yes	e.g. redis://:password@localhost:6379/0 (or TMI_REDIS_HOST/TMI_REDIS_PORT/TMI_REDIS_PASSWORD/TMI_REDIS_DB)

See Configuration-Reference for the full list.

Running Locally

docker run -p 8080:8080 \
  -v /path/to/wallet:/wallet:ro \
  -e TMI_DATABASE_URL=oracle://your_user:your_password@your_tns_alias \
  -e TMI_REDIS_URL=redis://host.docker.internal:6379 \
  <your-oracle-server-image>

The entrypoint extracts wallet.zip from the /wallet mount to /tmp/wallet, rewrites the DIRECTORY path in sqlnet.ora, and sets TNS_ADMIN and TMI_ORACLE_WALLET_LOCATION. For a local dev server against Oracle ADB, make dev-up DB=oracle is also available (see Local-Development-Cluster).

Oracle Wallet Configuration

1. Download the wallet ZIP for your Autonomous Database from the Oracle Cloud Console (DB Connection > Download Wallet).
2. Put wallet.zip in a directory and mount it read-only at /wallet.

You can instead pre-extract the wallet; it should contain tnsnames.ora, sqlnet.ora, and cwallet.sso.

Security

• Non-root runtime user; security patches applied during build; minimal runtime dependencies.
• Keep wallet files and database credentials out of images and version control; mount the wallet read-only.
• Scan images with --scan (Grype + Syft SBOM) or make scan-containers; reports (SARIF, text, CycloneDX) are written to security-reports/.

Troubleshooting

Oracle Connection Issues

1. Verify the wallet is mounted at /wallet and contains wallet.zip (the entrypoint logs the extraction).
2. Check the TNS alias in TMI_DATABASE_URL matches tnsnames.ora.
3. Ensure TNS_ADMIN points at the extracted wallet directory.
4. Verify the database user has the required permissions.

Build Failures

The Dockerfile auto-detects architecture (amd64/arm64). Cross-platform builds need Docker buildx.

Related Documentation

• Database-Setup -- Database installation and configuration
• Deploying-TMI-Server -- General server deployment
• Terraform-Deployment -- AWS deployment
• Configuration-Reference -- Configuration variables