Rootless container

backend/Dockerfile

@@ -67,7 +67,7 @@ RUN chmod +x /code/entrypoint.sh \
 RUN python3 manage.py collectstatic --noinput --verbosity 2
 
 # Expose ports
-EXPOSE 80 8000
+EXPOSE 8080 8000
 
 # Start with an entrypoint that runs init tasks then starts supervisord
 ENTRYPOINT ["/code/entrypoint.sh"]

backend/nginx.conf

@@ -1,19 +1,32 @@
 worker_processes 1;
+
+error_log  /tmp/nginx_error.log notice;
+pid        /tmp/nginx.pid;
+
 events {
     worker_connections 1024;
 }
+
 http {
+    proxy_temp_path /tmp/proxy_temp;
+    client_body_temp_path /tmp/client_temp;
+    fastcgi_temp_path /tmp/fastcgi_temp;
+    uwsgi_temp_path /tmp/uwsgi_temp;
+    scgi_temp_path /tmp/scgi_temp;
+
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
     sendfile        on;
     keepalive_timeout  65;
     client_max_body_size 100M;
+    access_log  /tmp/nginx_access.log;
+
     # The backend is running in the same container, so reference localhost
     upstream django {
         server 127.0.0.1:8000;  # Use localhost to point to Gunicorn running internally
     }
     server {
-        listen 80;
+        listen 8080;
         server_name localhost;
         location / {
             proxy_pass http://django;  # Forward to the upstream block
@@ -39,4 +52,4 @@ http {
             add_header Referrer-Policy "strict-origin-when-cross-origin" always;
         }
     }
-}
+}

backend/server/main/settings.py

@@ -368,7 +368,7 @@ def env(*keys, default=None):
         },
         'file': {
             'class': 'logging.FileHandler',
-            'filename': 'scheduler.log',
+            'filename': getenv('LOG_FILE', 'scheduler.log'),
         },
     },
     'root': {

backend/supervisord.conf

@@ -1,5 +1,7 @@
 [supervisord]
 nodaemon=true
+logfile=/tmp/supervisord.log
+pidfile=/tmp/supervisord.pid
 
 [program:nginx]
 command=/usr/sbin/nginx -g "daemon off;"

docker-compose.yml

@@ -25,7 +25,7 @@ services:
     restart: unless-stopped
     env_file: .env
     ports:
-      - "${BACKEND_PORT:-8016}:80"
+      - "${BACKEND_PORT:-8016}:8080"
     depends_on:
       - db
     volumes:

documentation/docs/configuration/rootless_mode.md

@@ -0,0 +1,12 @@
+# Rootless Mode
+
+To enable rootless mode, you must:
+
+- set a non-root user to run the container (any UID will work)
+- update ownership of media volume (mounted as `/code/media/`) to your selected UID
+- set the following environment variable for server service
+
+```yaml
+environment:
+  - LOG_FILE=/tmp/scheduler.log
+```

documentation/docs/install/docker.md

@@ -67,6 +67,7 @@ The `.env` file contains all the configuration settings for your AdventureLog in
 ## Optional Configuration
 
 - [Disable Registration](../configuration/disable_registration.md)
+- [Rootless mode](../configuration/rootless_mode.md)
 - [Google Maps](../configuration/google_maps_integration.md)
 - [Email Configuration](../configuration/email.md)
 - [Immich Integration](../configuration/immich_integration.md)

documentation/docs/install/nginx_proxy_manager.md

@@ -43,6 +43,6 @@ networks:
    - **Domain Names**: Enter the domain name where you will be hosting AdventureLog.
    - **Scheme**: `http`
    - **Forward Hostname/IP**: `adventurelog-backend` The name of the AdventureLog **backend** container in the `docker-compose.yml` file.
-   - **Forward Port**: `80` This is the internal port of the AdventureLog **backend** container so you will not need to change it even if you change the external port.
+   - **Forward Port**: `8080` This is the internal port of the AdventureLog **backend** container so you will not need to change it even if you change the external port.
 
 This will allow you to access AdventureLog using the domain name you specified in the Nginx Proxy Manager configuration.

kustomization.yml

@@ -61,7 +61,7 @@ spec:
           image: ghcr.io/seanmorley15/adventurelog-backend:latest
           imagePullPolicy: IfNotPresent
           ports:
-            - containerPort: 80
+            - containerPort: 8080
             - containerPort: 8000
           volumeMounts:
             - name: adventure-journal
@@ -122,8 +122,8 @@ spec:
   ports:
     - name: http
       protocol: TCP
-      port: 80
-      targetPort: 80
+      port: 8080
+      targetPort: 8080
     - name: base
       protocol: TCP
       port: 8000