Some questions & problems with docker-compose

[mstimvol]

Hi,

at first - thank you very much for this great project! Unfortunately I've some questions and problems with the setup.

I've the following docker-compose file:

services:
  postgres:
    image: postgres:16-alpine
    container_name: artifact-keeper-db
    environment:
      POSTGRES_USER: registry
      POSTGRES_PASSWORD: registry
      POSTGRES_DB: artifact_registry
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init-db.sql:/docker-entrypoint-initdb.d/init-db.sql:ro,z
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U registry -d artifact_registry"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  backend:
    image: artifactkeeper/backend:main-alpine
    container_name: artifact-keeper-backend
    depends_on:
      postgres:
        condition: service_healthy
      meilisearch:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://registry:registry@postgres:5432/artifact_registry
      STORAGE_PATH: /data/storage
      BACKUP_PATH: /data/backups
      PLUGINS_DIR: /data/plugins
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production-please}
      ADMIN_PASSWORD: "CHANGE_ME"
      RUST_LOG: ${RUST_LOG:-info,artifact_keeper=debug}
      ENVIRONMENT: ${ENVIRONMENT:-development}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost,https://localhost}
      TRIVY_URL: http://trivy:8090
      OPENSCAP_URL: http://openscap:8091
      SCAN_WORKSPACE_PATH: /scan-workspace
      MEILISEARCH_URL: http://meilisearch:7700
      MEILISEARCH_API_KEY: ${MEILI_MASTER_KEY:-artifact-keeper-dev-key}
      # Dependency-Track integration (API key auto-provisioned by dtrack-init)
      DEPENDENCY_TRACK_URL: http://dependency-track-apiserver:8080
      DEPENDENCY_TRACK_ENABLED: ${DEPENDENCY_TRACK_ENABLED:-true}
      DEPENDENCY_TRACK_API_KEY: ""
      ALLOW_HTTP_INTEGRATIONS: "1"
      HOST: 0.0.0.0
      PORT: 8080
    volumes:
      - artifact_storage:/data/storage
      - backup_storage:/data/backups
      - plugins_storage:/data/plugins
      - scan_workspace:/scan-workspace
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/livez"]
      interval: 30s
      timeout: 10s
      start_period: 10s
      retries: 3
    restart: unless-stopped

  meilisearch:
    image: getmeili/meilisearch:v1.12
    container_name: artifact-keeper-meilisearch
    environment:
      MEILI_MASTER_KEY: ${MEILI_MASTER_KEY:-artifact-keeper-dev-key}
      MEILI_ENV: development
      MEILI_NO_ANALYTICS: true
    volumes:
      - meilisearch_data:/meili_data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7700/health"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  trivy:
    image: aquasec/trivy:latest
    container_name: artifact-keeper-trivy
    command: ["server", "--listen", "0.0.0.0:8090"]
    volumes:
      - trivy_cache:/root/.cache/trivy
      - scan_workspace:/scan-workspace:ro
    restart: unless-stopped

  openscap:
    image: ghcr.io/artifact-keeper/artifact-keeper-openscap:latest  # or artifactkeeper/openscap:latest
    container_name: artifact-keeper-openscap
    volumes:
      - scan_workspace:/scan-workspace:ro
    healthcheck:
      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8091/health')"]
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped

  # OWASP Dependency-Track for SBOM analysis and vulnerability tracking
  # https://wdependencytrack.org/
  dependency-track-apiserver:
    image: dependencytrack/apiserver:4.14.0-alpine
    container_name: artifact-keeper-dtrack-api
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      ALPINE_DATABASE_MODE: external
      ALPINE_DATABASE_URL: jdbc:postgresql://postgres:5432/dependency_track
      ALPINE_DATABASE_DRIVER: org.postgresql.Driver
      ALPINE_DATABASE_USERNAME: registry
      ALPINE_DATABASE_PASSWORD: registry
      # API configuration
      ALPINE_DATA_DIRECTORY: /data
      # Enable API key authentication
      ALPINE_ENFORCE_AUTHENTICATION: "false"
      # Optional: Enable CORS for frontend
      ALPINE_CORS_ENABLED: "true"
      ALPINE_CORS_ALLOW_ORIGIN: "*"
      ALPINE_DATABASE_NVD_MIRROR_ENABLED: "false"
      ALPINE_DATABASE_NVD_ENABLED: "true"
      ALPINE_DATABASE_NVD_FEEDS_ENABLED: "false"
      # Proxy configuration (required for NVD mirroring behind corporate proxies)
      ALPINE_HTTP_PROXY_ADDRESS: ${DTRACK_HTTP_PROXY_ADDRESS:-}
      ALPINE_HTTP_PROXY_PORT: ${DTRACK_HTTP_PROXY_PORT:-}
      ALPINE_HTTP_PROXY_USERNAME: ${DTRACK_HTTP_PROXY_USERNAME:-}
      ALPINE_HTTP_PROXY_PASSWORD: ${DTRACK_HTTP_PROXY_PASSWORD:-}
      ALPINE_NO_PROXY: ${DTRACK_NO_PROXY:-localhost,127.0.0.1}
    ports:
      - 30080:8080
    volumes:
      - dtrack_data:/data
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/version"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 5
    restart: unless-stopped

  web:
    image: ghcr.io/artifact-keeper/artifact-keeper-web:latest  # or artifactkeeper/web:latest
    container_name: artifact-keeper-web
    depends_on:
      backend:
        condition: service_started
    environment:
      STORAGE_PATH: /data/storage
      BACKEND_URL: http://backend:8080
    volumes:
      - artifact_storage:/data/storage
    restart: unless-stopped

  caddy:
    image: caddy:2-alpine
    container_name: artifact-keeper-caddy
    depends_on:
      backend:
        condition: service_started
      web:
        condition: service_started
    environment:
      SITE_ADDRESS: ${SITE_ADDRESS:-localhost}
    ports:
      - 3000:80
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro,z
      - caddy_data:/data
      - caddy_config:/config
    restart: unless-stopped

volumes:
  postgres_data:
    driver: local
  artifact_storage:
    driver: local
  backup_storage:
    driver: local
  plugins_storage:
    driver: local
  trivy_cache:
    driver: local
  meilisearch_data:
    driver: local
  scan_workspace:
    driver: local
  caddy_data:
    driver: local
  caddy_config:
    driver: local
  dtrack_data:
    driver: local

networks:
  default:
    name: artifact-keeper-network

It is based on https://github.com/artifact-keeper/artifact-keeper/blob/main/docker-compose.yml with a few changes:

1. I removed the pg-certs because I don't need SSL because everything is internally. So it's ok for no to have this.
2. Updated Dependency-Track API-Server to 4.14.0 because I had trouble with 4.11.4 from the original one (downloading old CVE signatures from the 1.1 feed which seems to be unavailable)
3. Use artifactkeeper/backend:main-alpine instead of ghcr.io/artifact-keeper/artifact-keeper-backend:latest
4. Allow anonymous API Access to Dependency-Track
5. Bind the storage volume to the web container
6. Changed the paths for init-sql and so on

In general it works, but I've a few questions and problems in general:

1. When I use artifact-keeper-backend:latest based on RHEL9, it is not able to extract zip files. For example, when I've a Composer repository and upload a zip file using the web frontend, it fails because it's missing unzip in the container. So I wonder whether this is intended or not. That's the reason for using main-alpine instead.
2. When I upload a rpm file to a RPM repository, OpenSCAP says: OpenSCAP scan failed for php85-php-fpm-8.5.3-1.el8.remi.x86_64.rpm: Internal error: OpenSCAP scan failed (HTTP 400 Bad Request): {"error": "scan path not found or not allowed"}. Returning empty findings.. When I upload the file, I expected that this is located somewhere in /scan-workspace, but there's no file. Why?
3. When starting the web frontend I see the following error and I wonder if this is normal:

artifact-keeper-web      | ▲ Next.js 16.1.6
artifact-keeper-web          | - Local:         http://localhost:3000
artifact-keeper-web          | - Network:       http://0.0.0.0:3000
artifact-keeper-web          |
artifact-keeper-web          | ✓ Starting...
artifact-keeper-web          | ✓ Ready in 563ms
artifact-keeper-web          | ⨯ Failed to write image to cache g3tsAmg58PZajcJy3bsB_YCctVrYNUtxix963I8ZV5c Error: EACCES: permission denied, mkdir '/app/.next/cache'
artifact-keeper-web          |     at ignore-listed frames {
artifact-keeper-web          |   errno: -13,
artifact-keeper-web          |   code: 'EACCES',
artifact-keeper-web          |   syscall: 'mkdir',
artifact-keeper-web          |   path: '/app/.next/cache'
artifact-keeper-web          | }

4. I added the storage volume to the web container because otherwise the backend would throw an file-not-found-error. So is it missing in the docker-compose template file (https://github.com/artifact-keeper/artifact-keeper/blob/main/docker-compose.yml)?

[itxashancode]

Your compose file is cut off at the end - looks like you're missing the rest of the meilisearch service and any other services like trivy, openscap, etc.

First thing I'd check: make sure all the services you reference in depends_on actually exist in the compose file. If trivy, openscap, or dependency-track-apiserver are missing, the backend will fail to start.

Also, JWT_SECRET and CORS_ORIGINS are using ${VAR:-default} syntax - that's fine, but if you want to override them in production, make sure the env vars are set before docker-compose up.

If you're hitting startup issues, run docker-compose up --no-deps backend to test the backend in isolation, and check logs with docker-compose logs backend.

What error are you seeing?