Add Docker configuration for local development#80
Conversation
Reviewer's GuideProvides Docker-based local development setup by introducing a Dockerfile for containerizing the Node server, a docker-compose configuration to orchestrate the application and Postgres service, and accompanying usage documentation in the README. Sequence Diagram:
|
| Change | Details | Files |
|---|---|---|
| Added Dockerfile for containerizing Node server |
|
Dockerfile |
| Introduced docker-compose setup for app and Postgres service |
|
docker-compose.yml |
| Documented Docker usage in README |
|
README.md |
Tips and commands
Interacting with Sourcery
- Trigger a new review: Comment
@sourcery-ai reviewon the pull request. - Continue discussions: Reply directly to Sourcery's review comments.
- Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with@sourcery-ai issueto create an issue from it. - Generate a pull request title: Write
@sourcery-aianywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai titleon the pull request to (re-)generate the title at any time. - Generate a pull request summary: Write
@sourcery-ai summaryanywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment@sourcery-ai summaryon the pull request to
(re-)generate the summary at any time. - Generate reviewer's guide: Comment
@sourcery-ai guideon the pull
request to (re-)generate the reviewer's guide at any time. - Resolve all Sourcery comments: Comment
@sourcery-ai resolveon the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore. - Dismiss all Sourcery reviews: Comment
@sourcery-ai dismisson the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai reviewto trigger a new review!
Customizing Your Experience
Access your dashboard to:
- Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others. - Change the review language.
- Add, remove or edit custom review instructions.
- Adjust other review settings.
Getting Help
- Contact our support team for questions or feedback.
- Visit our documentation for detailed guides and information.
- Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 17706302 | Triggered | Generic Password | bea6656 | docker-compose.yml | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hello @numbpill3d, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
Summary of Changes
Hello team, gemini-code-assist here to provide a summary of this pull request by @numbpill3d. The main goal of this PR is to introduce a Docker-based setup for local development. This includes containerizing the Node.js application and setting up a PostgreSQL database service using docker-compose, making it significantly easier for developers to get the project running quickly without manual installation of Node.js and PostgreSQL dependencies directly on their machines.
Highlights
- Docker Setup Added: This pull request introduces a complete Docker setup for local development. It includes a
Dockerfileto build the Node.js application image and adocker-compose.ymlfile to orchestrate the application container alongside a PostgreSQL database service. - PostgreSQL Service Included: The
docker-compose.ymlfile defines a PostgreSQL database service (db) using thepostgres:15-alpineimage, configured with default credentials and a persistent volume (db-data) for storing database files. - Local App Container: The
docker-compose.ymldefines anappservice that builds the application image using the newDockerfile, maps port 3000, sets necessary environment variables (including the database connection string pointing to thedbservice and secrets pulled from the host environment), and ensures the database service is started first viadepends_on. - Documentation Updated: The
README.mdfile has been updated with a new section titled "Docker Usage", providing clear instructions on how to use the new Docker setup, including creating a.envfile and running thedocker-compose up --buildcommand.
Changelog
Click here to see the changelog
- Dockerfile
- Added a new Dockerfile to containerize the Node.js application.
- Uses
node:20-alpineas the base image. - Sets the working directory to
/usr/src/app. - Copies
package*.jsonand runsnpm ci --omit=devto install production dependencies. - Copies the rest of the application source code.
- Exposes port 3000.
- Sets the default command to run the server using
node server.js.
- README.md
- Added a new section "Docker Usage" (starting around line 159).
- Provides step-by-step instructions for running the application with Docker.
- Mentions the requirement for a
.envfile. - Includes the
docker-compose up --buildcommand. - Specifies the local access URL (
http://localhost:3000).
- docker-compose.yml
- Added a new docker-compose file (version '3.8').
- Defines an
appservice: -
- Builds from the current directory (using the Dockerfile).
-
- Maps host port 3000 to container port 3000.
-
- Sets environment variables, including
PORT,DATABASE_URL(pointing to thedbservice), and Supabase/Session secrets sourced from the host environment.
- Sets environment variables, including
-
- Depends on the
dbservice.
- Depends on the
- Defines a
dbservice: -
- Uses the
postgres:15-alpineimage.
- Uses the
-
- Sets PostgreSQL environment variables (
POSTGRES_USER,POSTGRES_PASSWORD,POSTGRES_DB).
- Sets PostgreSQL environment variables (
-
- Mounts the
db-datavolume for data persistence.
- Mounts the
- Defines the
db-datavolume.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||
There was a problem hiding this comment.
Code Review
This pull request introduces Docker configuration for local development, including a Dockerfile for the Node server and a docker-compose setup with a Postgres database. This is a valuable addition for simplifying the development environment setup.
The changes are well-structured, adding the necessary files and documentation. However, there is a critical issue regarding the application's database connection logic when running within the Docker Compose environment. The application currently attempts to connect to Supabase using the SUPABASE_URL environment variable, which will point to the remote Supabase instance, rather than using the local Postgres database service defined in the docker-compose.yml file. This will prevent the application from functioning correctly with the local database setup.
Additionally, there are some areas for improvement related to Docker best practices and documentation clarity, which are detailed in the review comments.
Summary of Findings
- Database Connection Logic in Docker: The application's
server.jsis hardcoded to connect to Supabase usingSUPABASE_URL. When running in Docker Compose, it needs to connect to the local Postgres service (db) using theDATABASE_URLprovided in the compose file. This requires changes in the application code to conditionally use the correct database connection string. - Dockerfile Security (Non-root User): The Dockerfile runs the application as the root user. It's a security best practice to run containers as a non-root user.
- Dockerfile Efficiency (.dockerignore): A
.dockerignorefile is missing, which can lead to unnecessary files being copied into the image, increasing its size and build time. - README Clarity (.env variables): The README should explicitly list all environment variables required in the
.envfile for the Docker Compose setup. - Dockerfile Efficiency (Multi-stage build): While not strictly necessary for local development, a multi-stage build could be used to create a smaller final image by excluding development dependencies and build tools. (Note: Not commented on directly due to review settings).
- Docker Compose Security (Hardcoded DB Credentials): The database credentials (
POSTGRES_USER,POSTGRES_PASSWORD) are hardcoded in thedocker-compose.yml. While acceptable for local development, this is not secure for production environments. (Note: Not commented on directly due to review settings).
Merge Readiness
This pull request introduces valuable Docker configurations for local development. However, the high-severity issue regarding the application's database connection logic needs to be addressed before merging. The application code must be updated to correctly connect to the local Postgres service when running via Docker Compose.
Once the database connection issue is resolved, and the medium-severity issues are considered (especially the .dockerignore for efficiency), the pull request will be in a good state to be merged. I am unable to approve the pull request directly; please have other reviewers approve this code after the necessary changes are made.
| environment: | ||
| - PORT=3000 | ||
| - DATABASE_URL=postgres://postgres:postgres@db:5432/wirebase | ||
| - SUPABASE_URL=${SUPABASE_URL} | ||
| - SUPABASE_KEY=${SUPABASE_KEY} | ||
| - SUPABASE_SERVICE_KEY=${SUPABASE_SERVICE_KEY} | ||
| - SESSION_SECRET=${SESSION_SECRET} |
There was a problem hiding this comment.
The application's database connection logic in server.js uses process.env.SUPABASE_URL to determine the database host for Knex, and also initializes Supabase clients using the Supabase keys. This means the app will attempt to connect to the remote Supabase instance even when running in Docker Compose.
To use the local Postgres service (db) defined in this file, the application code needs to be updated to conditionally use the DATABASE_URL environment variable (which points to the db service) when running in the Docker Compose environment (e.g., based on a new IS_DOCKER environment variable). This is a critical correctness issue that will prevent the app from working with the local database.
| FROM node:20-alpine | ||
| WORKDIR /usr/src/app | ||
| COPY package*.json ./ | ||
| RUN npm ci --omit=dev | ||
| COPY . . | ||
| EXPOSE 3000 | ||
| CMD ["node","server.js"] |
There was a problem hiding this comment.
It's generally recommended to run containers as a non-root user for security reasons. While less critical for local development, adopting this practice early is beneficial.
FROM node:20-alpine
WORKDIR /usr/src/app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 3000
USER node
CMD ["node","server.js"]
| WORKDIR /usr/src/app | ||
| COPY package*.json ./ | ||
| RUN npm ci --omit=dev | ||
| COPY . . |
There was a problem hiding this comment.
The COPY . . instruction copies all files from the build context into the image. Without a .dockerignore file, this can include unnecessary files like .git, node_modules (if present locally), or build artifacts, increasing image size and build time. Consider adding a .dockerignore file to exclude these.
|
|
||
| To run Wirebase locally with Docker: | ||
|
|
||
| 1. Create a `.env` file using the environment variables shown above. |
There was a problem hiding this comment.
The .env file needs to contain the Supabase keys (SUPABASE_URL, SUPABASE_KEY, SUPABASE_SERVICE_KEY) and SESSION_SECRET as these are passed through to the container via docker-compose.yml. The example .env section above only lists PORT and NODE_ENV. It would be helpful to explicitly list all required variables for the Docker setup here.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @numbpill3d - I've reviewed your changes and they look great!
Blocking issues:
- By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. (link)
Here's what I looked at during the review
- 🟡 General issues: 4 issues found
- 🔴 Security: 1 blocking issue
- 🟢 Testing: all looks good
- 🟢 Complexity: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| @@ -0,0 +1,25 @@ | |||
| version: '3.8' | |||
| services: | |||
| app: | |||
There was a problem hiding this comment.
suggestion: Add a restart policy for the app service
Consider adding a restart policy (e.g., unless-stopped or always) to ensure the container restarts automatically after crashes or reboots.
| - SESSION_SECRET=${SESSION_SECRET} | ||
| depends_on: | ||
| - db | ||
| db: |
There was a problem hiding this comment.
suggestion: Add a healthcheck for the database service
This will help prevent startup connection errors by ensuring the app only starts when the database is ready.
| @@ -0,0 +1,7 @@ | |||
| FROM node:20-alpine | |||
There was a problem hiding this comment.
suggestion (performance): Add a .dockerignore to reduce build context
Exclude node_modules, .git, and logs in your .dockerignore to speed up builds and reduce image size.
Suggested implementation:
node_modules
.git
logs
*.log
npm-debug.log
| The app will be available at `http://localhost:3000`. | ||
|
|
||
| ## License |
There was a problem hiding this comment.
suggestion: Consider adding instructions for stopping the Docker containers.
Including a note about using docker-compose down would help users clean up containers after running the app.
| The app will be available at `http://localhost:3000`. | |
| ## License | |
| The app will be available at `http://localhost:3000`. | |
| 3. To stop and remove the containers, networks, and volumes created by `up`, run: | |
| ```bash | |
| docker-compose down |
License
| RUN npm ci --omit=dev | ||
| COPY . . | ||
| EXPOSE 3000 | ||
| CMD ["node","server.js"] |
There was a problem hiding this comment.
security (missing-user): By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
| CMD ["node","server.js"] | |
| USER non-root | |
| CMD ["node","server.js"] |
Source: opengrep
1 participant
Summary
Testing
npm test(fails: Cannot find module and missing Supabase env)https://chatgpt.com/codex/tasks/task_e_68450dc76f68832f93ce610070f06a70
Summary by Sourcery
Provide Docker-based local development setup with a Dockerfile, Docker Compose configuration for the Node app and Postgres, and update the README with usage instructions.
Build:
Documentation: