mrcharles
1cc0063e03
Official-image wrapper of elabftw/elabimg 5.6.12 (tag+digest pinned); localstorage + mysql + ldap addons; httpPort 443 via DISABLE_HTTPS. No OIDC upstream -> native LDAP flagged auth-risk. First mysql-addon and first Business-Apps package; 15/~57. Build verified green under ukrrs-batch.slice. Docs synced (JOURNAL s15, README, STATUS). Detail + verification: https://projects.knownelement.com/issues/669#note-3938
41 lines
2.1 KiB
Docker
41 lines
2.1 KiB
Docker
# eLabFTW Cloudron Package
|
|
#
|
|
# eLabFTW is an open-source electronic lab notebook (ELN) for research
|
|
# teams: experiments, inventory, scheduling, timestamps and PDF export,
|
|
# backed by MySQL. Packaged as an official-image wrapper around the
|
|
# upstream elabimg image (nginx + php-fpm + s6-overlay in one container).
|
|
#
|
|
# Upstream: https://github.com/elabftw/elabftw
|
|
# - The elabimg build lives in-tree (containers/elabimg/) but compiles
|
|
# nginx, OpenBabel and the whole yarn/composer asset pipeline from
|
|
# source; the published image is the supported distribution channel.
|
|
# - elabimg 5.6.12 with DISABLE_HTTPS=true serves plain HTTP on port
|
|
# 443 (Cloudron terminates TLS at the platform proxy).
|
|
# - DB schema: AUTO_DB_INIT / AUTO_DB_UPDATE run `bin/init db:install`
|
|
# / `bin/console db:update` from the image entrypoint; start.sh
|
|
# gates them behind a MySQL wait loop.
|
|
#
|
|
# Authentication: NO OIDC upstream (v5.6 auth methods: local, SAML, LDAP).
|
|
# Verdict per AGENTS.md: native LDAP = acceptable with auth-risk flag.
|
|
# The manifest enables the `ldap` addon so CLOUDRON_LDAP_* credentials are
|
|
# available; the sysconfig admin wires them into Admin panel -> LDAP (see
|
|
# README). SAML is also available for an external IdP.
|
|
#
|
|
# Pattern: official-image wrapper. Image pinned by tag AND digest (amd64
|
|
# manifest digest of the 5.6.12 tag, from the Docker Hub registry API).
|
|
FROM elabftw/elabimg:5.6.12@sha256:e91fcc92f0c9a3190ac4f8db7fad03703f1662b33856a53baba9b5a06d71a51d
|
|
|
|
# start.sh waits for the mysql addon, persists the SECRET_KEY, maps the
|
|
# Cloudron env into elabimg's DB_*/SITE_URL/DISABLE_HTTPS variables,
|
|
# binds uploads + exports under /app/data and execs the s6 init.
|
|
# Made executable on the host, not at build time (Cloudron builds hit
|
|
# permission errors on RUN chmod). bash ships with elabimg.
|
|
COPY start.sh /app/start.sh
|
|
|
|
# elabimg HTTP mode (DISABLE_HTTPS=true) listens here; no other listener.
|
|
EXPOSE 443
|
|
|
|
# s6-overlay must run as root: the upstream entrypoint creates the
|
|
# unprivileged nginx/php user and drops privileges for the services.
|
|
ENTRYPOINT ["/bin/bash", "/app/start.sh"]
|