feat(docker): containerized web build + CORS guidance#23
Merged
Conversation
Multi-stage Dockerfile (node:22-alpine + pnpm build -> nginx-unprivileged serve) producing a non-root image that runs under read-only fs + cap_drop ALL. nginx.conf does SPA-fallback routing, /healthz, immutable asset cache, and gzip, plus an opt-in same-origin reverse-proxy block. docs/docker.md documents build/run and the two ways to handle browser CORS on the web build (configure Honcho's CORSMiddleware, or the nginx proxy). The Dockerfile and nginx.conf are adapted from @zmarakjanbangash's fork. Co-authored-by: zmarakjanbangash <zmarakjanbangash@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Docker support for the
@openconcho/webSPA — a recurring ask.nginx-unprivilegedserves it). Non-root (UID 101) on :8080, runs under--read-only --cap-drop ALL./healthz, immutable asset caching, gzip, and an opt-in same-origin reverse-proxy block.On CORS (the second half of the ask)
The desktop app routes fetch through Rust and bypasses browser CORS; the web build doesn't. Two documented options: (1) configure Honcho's FastAPI
CORSMiddlewarefor the UI origin — recommended, fits the absolute-URL-in-localStorage model; (2) the nginx reverse-proxy block for zero-CORS same-origin. Option 2 needs the Settings form to accept a relative base URL (currentlyz.string().url()requires absolute) — flagged as follow-up in the docs.Credit
Dockerfile + nginx.conf adapted from @zmarakjanbangash's fork. Thanks!
Verification
docker buildsucceeds; container smoke-tested —/healthzreturns ok, index serves, SPA deep-link returns 200.