ducoterra
426682a999
The README referenced `deploy/install-agent.sh` and a `Containerfile` that did not exist, so a fresh clone had no way to actually run this anywhere. * agent: `--token-file` (and AGENT_TOKEN_FILE). The token guards hostname, mounts, disk and GPU models and process names, and argv is world-readable through `ps`, so a file has to win over the flag. Missing or empty token files are fatal — falling back to "no token" would expose the host. * deploy/install-agent.sh: creates a system user, generates the token once (re-runs reuse it, --rotate-token for a new one), stores it 0600 root-owned, and runs the agent under ProtectSystem=strict with no capabilities; --status and --uninstall included. * Containerfile: two-stage, uv.lock resolved in the builder and slim Python in the runtime. Verified with podman — the image serves /api/health as an unprivileged user and writes its history under /var/lib/dashboards. UV_PROJECT_ENVIRONMENT and --no-editable are what make the venv survive being copied into the runtime stage. * .containerignore keeps .git, .venv, data/ and .env out of the build context. 258 tests, 94% coverage; ruff and pyright clean. LLM-Generated: true
53 lines
2.4 KiB
Docker
53 lines
2.4 KiB
Docker
# Homelab dashboards — one image, three dashboards, one port.
|
|
#
|
|
# podman build -t dashboards .
|
|
# podman run --rm -p 8090:8090 --env-file dashboards.env \
|
|
# -v dashboards-data:/var/lib/dashboards dashboards
|
|
#
|
|
# Two stages: the builder resolves `uv.lock` (exactly the versions the tests ran against),
|
|
# the runtime stage is a plain slim Python with only the installed venv in it. No build
|
|
# toolchain, no source, no dev dependencies in the final image.
|
|
|
|
FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim AS builder
|
|
WORKDIR /app
|
|
# The venv is built at the path it will run from: a venv moved out of place has shebangs and
|
|
# a `bin/python` symlink pointing at wherever it was built, which fails at exec time with a
|
|
# confusing "missing dynamic library?".
|
|
ENV UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never UV_PROJECT_ENVIRONMENT=/opt/venv
|
|
# manifest first: a source-only change must not re-resolve the dependency graph
|
|
COPY pyproject.toml uv.lock README.md ./
|
|
RUN uv sync --frozen --no-dev --no-install-project
|
|
COPY src ./src
|
|
# --no-editable matters: uv installs the project editable by default, which leaves a .pth
|
|
# pointing at /app/src — a path that only exists in the builder, and the app then dies at
|
|
# import time with "No module named dashboards".
|
|
RUN uv sync --frozen --no-editable
|
|
|
|
FROM python:3.14-slim
|
|
# no image.source label: the origin is set once this repo has one
|
|
LABEL org.opencontainers.image.title="homelab dashboards" \
|
|
org.opencontainers.image.description="System, LLM engine and UPS battery dashboards on one domain"
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PATH=/opt/venv/bin:$PATH \
|
|
DASH_HOST=0.0.0.0 \
|
|
DASH_PORT=8090 \
|
|
DASH_DB=/var/lib/dashboards/dashboards.sqlite3
|
|
|
|
RUN useradd --system --uid 10001 --home-dir /var/lib/dashboards --create-home dashboards
|
|
COPY --from=builder /opt/venv /opt/venv
|
|
# the host agent ships in the same image so one container can monitor the box it runs on
|
|
COPY agent/host_agent.py /opt/dashboards/agent/host_agent.py
|
|
|
|
VOLUME /var/lib/dashboards
|
|
EXPOSE 8090
|
|
USER dashboards
|
|
|
|
# /api/health answers "empty" (200) with no sources configured, so a container that starts
|
|
# before its env file is right still passes the probe instead of crash-looping.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD ["python", "-c", "import sys,urllib.request; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8090/api/health', timeout=4).status == 200 else 1)"]
|
|
|
|
CMD ["dashboards"]
|