BoxBox/docker-compose.yml at master · jR4dh3y/BoxBox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# =============================================================================
# BoxBox Docker Compose
# =============================================================================
# Single-container deployment for homelab/NAS file management.
#
# Usage:
#   1. Copy .env.example to .env and configure your settings.
#   2. Run: docker compose pull && docker compose up -d
#   3. Access at http://localhost:${HOST_PORT:-8080}
#
# Uses normal host port binding by default.
# =============================================================================

services:
  boxbox:
    image: ${BOXBOX_IMAGE:-ghcr.io/jr4dh3y/boxbox:latest}
    container_name: boxbox
    restart: unless-stopped
    env_file:
      - .env
    ports:
      - "${HOST_PORT:-8080}:80"
    environment:
      - BOXBOX_JWT_SECRET=${BOXBOX_JWT_SECRET:?Set BOXBOX_JWT_SECRET in .env}
      - BOXBOX_USERS_admin=${BOXBOX_USERS_admin:?Set BOXBOX_USERS_admin in .env}
      - BOXBOX_RATE_LIMIT_RPS=${BOXBOX_RATE_LIMIT_RPS:-10}
      - BOXBOX_ALLOWED_ORIGINS=${BOXBOX_ALLOWED_ORIGINS:-}
      - CONFIG_PATH=/app/config.yaml
      - TMPDIR=/tmp/boxbox
    volumes:
      # Configuration
      - ./backend/config.yaml:/app/config.yaml:ro

      # Mount points for file access (customize these for your setup)
      # rslave enables mount propagation so container sees new host mounts
      - /media/devmon:/media/devmon:rslave
      - /:/host_root:ro,rslave
      - ${HOME_PATH:-${HOME:-/home/user}}:/home/user

      # Sidebar quick-access folders. By default these point inside HOME_PATH,
      # or the host user's HOME when HOME_PATH is unset.
      # Set any *_PATH variable in .env to map that shortcut to a custom host path.
      - ${DESKTOP_PATH:-${HOME_PATH:-${HOME:-/home/user}}/Desktop}:/home/user/Desktop
      - ${DOWNLOADS_PATH:-${HOME_PATH:-${HOME:-/home/user}}/Downloads}:/home/user/Downloads
      - ${DOCUMENTS_PATH:-${HOME_PATH:-${HOME:-/home/user}}/Documents}:/home/user/Documents
      - ${MUSIC_PATH:-${HOME_PATH:-${HOME:-/home/user}}/Music}:/home/user/Music
      - ${PICTURES_PATH:-${HOME_PATH:-${HOME:-/home/user}}/Pictures}:/home/user/Pictures
      - ${VIDEOS_PATH:-${HOME_PATH:-${HOME:-/home/user}}/Videos}:/home/user/Videos

      # Persistent storage
      - boxbox-temp:/tmp/boxbox
      - boxbox-data:/data

    # Security: Run without full privileges, only necessary capabilities
    privileged: false
    cap_add:
      - DAC_READ_SEARCH  # Read files regardless of permission bits
      - CHOWN            # Change file ownership
      - FOWNER           # Bypass permission checks for file owner

    security_opt:
      - no-new-privileges:true

    # Resource limits
    deploy:
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 128M

    # Health monitoring
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:80/health | grep -q 'ok' || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  boxbox-temp:
    driver: local
  boxbox-data:
    driver: local