shadowdaoandClaude Opus 5
e417a908f2
Base image moves from AlmaLinux 9 to 10, which forces two related changes: EPEL repo URL bumps to the el10 release RPM, and tini is replaced with dumb-init as PID 1 since tini is not packaged in EPEL 10. Both provide the signal forwarding and zombie reaping the wedged-container fix relies on. Nginx 1.26 in AlmaLinux 10 deprecates the `listen ... http2` parameter, so the server block now uses the separate `http2 on;` directive. Also fixes three issues that affected WebSocket apps (socket.io, ws): - `Connection: upgrade` was hardcoded on every proxied request, including ordinary HTTP. Now driven by a `map $http_upgrade $connection_upgrade` so only genuine upgrade requests carry it. - No explicit proxy read/send timeout meant idle WebSockets were cut at nginx's 60s default. Set to 600s, which clears any sane heartbeat without pinning connection slots (worker_connections is 512, two per client). - `large_client_header_buffers 2 1k` returned 400 for any single header line over 1KB, which session cookies and bearer tokens routinely exceed. Raised to the nginx default of 4 8k; buffers are allocated on demand, so this only costs memory for requests that need it. Verified by rendering the generated config and running it under nginx with a Node backend: WebSocket handshakes return 101 and reach the upstream 'upgrade' event, polling requests arrive with `Connection: close`, and a 3KB cookie returns 200 where the old buffer setting returned 400. README gains a WebSocket Support section covering the PM2 cluster-mode trap, the concurrency ceiling, and reconnects on memory restarts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
42 lines
1.6 KiB
Docker
42 lines
1.6 KiB
Docker
FROM almalinux/10-base
|
|
ARG NODEVER=20
|
|
|
|
# Install repos, update, install only needed packages, clean up in one layer
|
|
RUN dnf install -y \
|
|
https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm && \
|
|
dnf update -y && \
|
|
dnf install -y wget procps cronie iproute nginx openssl git microdnf make gcc gcc-c++ dumb-init && \
|
|
dnf group install -y 'Development Tools' && \
|
|
dnf clean all && \
|
|
rm -rf /var/cache/dnf /usr/share/doc /usr/share/man /usr/share/locale/* \
|
|
/var/cache/yum /tmp/* /var/tmp/*
|
|
|
|
# Copy scripts into the image and set permissions
|
|
COPY ./scripts/ /scripts/
|
|
RUN chmod +x /scripts/*
|
|
|
|
# Generate self-signed cert, create needed dirs, install Node.js, clean up
|
|
RUN openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/localhost.key -x509 -days 3650 -subj "/CN=localhost" -out /etc/pki/tls/certs/localhost.crt && \
|
|
mkdir -p /var/log/nodejs && \
|
|
/scripts/install-node$NODEVER.sh && \
|
|
rm -rf /tmp/*
|
|
|
|
# Install PM2 globally for process management with minimal footprint
|
|
RUN npm install -g pm2@latest --production && \
|
|
npm cache clean --force && \
|
|
rm -rf /tmp/*
|
|
|
|
# Copy nginx config
|
|
COPY ./configs/nginx.conf /etc/nginx/nginx.conf
|
|
|
|
# Copy examples directory for default app fallback
|
|
COPY ./examples/ /examples/
|
|
|
|
# Set up cron job for log rotation
|
|
RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
|
|
CMD bash -c ': </dev/tcp/127.0.0.1/3000 && : </dev/tcp/127.0.0.1/80' \
|
|
|| exit 1
|
|
|
|
ENTRYPOINT [ "/scripts/entrypoint.sh" ] |