mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 18:34:02 +00:00
SM-26andClaude Opus 5.5
79a6a0db5c
Two findings from PoBruno's Docker Engine on Linux run (#208), and one from re-running the suite in the container after rebasing: - The launcher pinned its own allowedHosts, including '.local'. Vite reads a leading dot as a suffix match, so `Host: anything.local` reached the page and the data proxies. Main has since moved the policy into build/allowedHosts.js, which drops suffix entries on purpose and applies before the app's routes, so the launcher's override is deleted rather than patched. As a side effect GEV_ALLOWED_HOSTS now also works from `.env`, as it does under `npm run dev`. - A checkout the container cannot write - typically a clone made as root on a NAS or Proxmox host - made Save Keys answer 500 and never created .gev-cache, with nothing logged. The launcher now warns at start, naming the owner, the ids it runs as, and the two fixes. - On Docker Desktop the bind-mounted repo always shows an owner other than the container user, so git refuses it as "dubious ownership" and the tests that shell out to git fail (src/data/bundledJson.test.mjs, new on main). The image now marks /app, and only /app, as a safe directory. Verified in a container on this base: `anything.local` 403 on the page and on /api routes, localhost 200, GEV_ALLOWED_HOSTS honoured from the environment and from .env, the warning on a root-owned /app run as 1000:1000, and bundledJson.test.mjs 6/6. Reported-by: PoBruno Co-Authored-By: Claude Opus 5.5 <[email protected]>
41 lines
1.9 KiB
Docker
41 lines
1.9 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# The dev server is the whole app: Vite serves the client AND runs the API
|
|
# proxies (ADS-B, AIS, Overpass, OpenAI Realtime, ...) as middleware, so there
|
|
# is nothing else to containerise. See compose.yaml for the usual entry point.
|
|
FROM node:24-slim
|
|
|
|
# Puppeteer is only used by the QA scripts; skip its ~150MB Chromium download.
|
|
ENV PUPPETEER_SKIP_DOWNLOAD=1
|
|
WORKDIR /app
|
|
|
|
# `npm test` builds fixtures with `git init`, so the suite cannot run in a
|
|
# container without it (71 failures on node:24-slim, all ENOENT on git).
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
|
|
# The repo is bind-mounted, so inside the container it can show an owner other
|
|
# than the user the container runs as - always, on Docker Desktop. git then
|
|
# refuses it as "dubious ownership", which fails the tests that shell out to
|
|
# git. It is the user's own checkout, so trust that one path.
|
|
RUN git config --system --add safe.directory /app
|
|
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci
|
|
# compose runs the container as the host user so bind-mounted files stay
|
|
# yours, but node_modules is baked in as root. Vite only needs to write its
|
|
# dep-optimizer cache, so open up those two directories rather than chowning
|
|
# a few hundred MB to a UID we cannot know at build time.
|
|
RUN mkdir -p node_modules/.vite && chmod 777 node_modules node_modules/.vite
|
|
|
|
COPY . .
|
|
|
|
# Bind to all interfaces, otherwise the published port hits nothing. Vite also
|
|
# relaxes allowedHosts when HOST is 0.0.0.0, which is what lets the browser
|
|
# reach it as "localhost".
|
|
ENV HOST=0.0.0.0
|
|
ENV PORT=4173
|
|
EXPOSE 4173
|
|
# The launcher is `npm run dev` plus one step: it trusts the container's
|
|
# gateway address for Provider Settings, because that is where Docker delivers
|
|
# the host's own browser from (never 127.0.0.1). See scripts/docker-start.mjs.
|
|
CMD ["node", "scripts/docker-start.mjs"]
|