publisher/docker-compose.example.yml at main · malloydata/publisher · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# Copyright (c) Credible Data Inc.
# SPDX-License-Identifier: MIT

# docker-compose.example.yml
#
# Example Compose file for running the Malloy Publisher from the
# pre-built `ms2data/malloy-publisher` image. Copy this to
# `docker-compose.yml` in your own project (or symlink it) and
# adjust the volume mounts to point at your own publisher.config.json
# before bringing the stack up.
#
# REST is on :4000 and MCP is on :4040. See docs/deployment.md for
# tag-scheme guidance (`:latest`, `:X.Y.Z`).
#
# The `publisher_data` named volume persists the per-environment
# package clones and DuckDB extension cache across container
# restarts, so the first-boot clone of sample packages from GitHub
# only happens once.
#
# The server runs as uid 1000, not root. A new `publisher_data` volume
# is created writable by it. One an earlier, root-run image created
# needs a one-time chown through Compose, from this directory:
#
#   docker compose run --rm --no-deps --user 0 --entrypoint chown \
#     publisher -R 1000:1000 /publisher/publisher_data
#
# Not `docker run -v publisher_data:...`: Compose names the volume
# `<project>_publisher_data`, so that would chown a new, empty one.
# Any other writable volume you add must be prepared for uid 1000 too;
# packages/server/README.docker.md explains how.

services:
  publisher:
    # For production deployments, pin a specific release rather than
    # tracking `:latest` (e.g. `ms2data/malloy-publisher:0.0.196`).
    image: ms2data/malloy-publisher:latest
    ports:
      - "4000:4000" # REST
      - "4040:4040" # MCP
    volumes:
      # Read only: the server only needs to read it, so bind it :ro. It must be
      # readable by uid 1000 (a 0644 file is).
      - ./publisher.config.json:/publisher/publisher.config.json:ro
      # Written: a new named volume here is seeded from the image, owned by
      # uid 1000. One created by an image older than 0.9.0 needs the one-time
      # chown in the comment at the top of this file.
      - publisher_data:/publisher/publisher_data
      # Written, when a DuckLake storage destination's bucketUrl is a local
      # path. Same seeding as publisher_data; leave it out otherwise.
      # - ducklake_data:/publisher/ducklake_data
      # Read only: a key file for GOOGLE_APPLICATION_CREDENTIALS. A gcloud
      # application-default credentials file is 0600 and uid 1000 cannot read
      # it; bind a copy made with `sudo install -o 1000 -g 1000 -m 0400`.
      # - ./secrets/key.json:/var/secrets/google/key.json:ro
    # Uncomment to override defaults. See packages/server/README.docker.md
    # for the full env-var table.
    # environment:
    #   LOG_LEVEL: info
    #   SHUTDOWN_DRAIN_DURATION_SECONDS: "10"
    restart: unless-stopped
    # The first boot clones sample packages from GitHub, which can
    # take ~30s on a slow link; `start_period` keeps the container
    # marked "starting" (not "unhealthy") during that window.
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fs http://localhost:4000/api/v0/status | grep -q '\"operationalState\":\"serving\"' || exit 1",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 90s

volumes:
  publisher_data:
  # ducklake_data: