sandreae / earthstar-docker Goto Github PK

For security reasons it's best practice not to copy/add any sensitive data into a container image during the build. Instead we rather pass allow_list.json in at runtime. This method might not be compatible with some deployment platforms (eg. fly.io) where you aren't able to over-ride the default docker run command.

For me, deploying on a dokku instance, i can take the following steps for a fairly easy deploy (it's also possible to provide a custom run command, but i thin the following method is nicer anyway):

1. create data/ and allows/ directory somewhere suitable on the host
2. set suitable permissions on these directories (deno:deno same as the container user)
3. create an allow_list.json in the allows/ directory
4. mount these directories as volumes in the container (can be done through dokku commands)

This is fairly straight forward and quite a familiar pattern for managing persistent storage for containers.

@sgwilym do you think this flow would work with fly.io? It would be good to find an easy deploy pattern which at least works for both of us, or if there is an even easier way, I'm veeeery open.

(I appreciate this is probably a stop-gap solution as you mentioned a future where there is a nice ui and all.....)