|
| 1 | +# Gitcord Docker Guide |
| 2 | + |
| 3 | +Docker support is designed for **mentor-friendly deployment** and **reproducible runs** without changing Gitcord’s offline-first architecture. The bot and `run-once` both work; SQLite and reports persist across restarts. |
| 4 | + |
| 5 | +--- |
| 6 | + |
| 7 | +## Why Docker? |
| 8 | + |
| 9 | +- **No local Python/setup**: Mentors run `docker compose up` after adding `.env` and config. |
| 10 | +- **Same behavior as CLI**: Same code paths; only the runtime is containerized. |
| 11 | +- **Persistent state**: Named volume keeps SQLite, reports, and identity links across restarts. |
| 12 | +- **Audit-first unchanged**: Dry-run and reports work the same; config and mutation policy are unchanged. |
| 13 | + |
| 14 | +--- |
| 15 | + |
| 16 | +## Quick Start (3 steps) |
| 17 | + |
| 18 | +1. **Create `.env`** in the project root (copy from `.env.example`): |
| 19 | + |
| 20 | + ```env |
| 21 | + GITHUB_TOKEN=your_fine_grained_pat |
| 22 | + DISCORD_TOKEN=your_discord_bot_token |
| 23 | + ``` |
| 24 | + |
| 25 | +2. **Create config** (use Docker-specific data dir): |
| 26 | + |
| 27 | + ```bash |
| 28 | + cp config/docker-example.yaml config/config.yaml |
| 29 | + ``` |
| 30 | + |
| 31 | + Edit `config/config.yaml`: set `github.org`, `discord.guild_id`, and any other options. **Do not change `data_dir`**; it must stay `/data` so the mounted volume is used. |
| 32 | + |
| 33 | +3. **Start the bot**: |
| 34 | + |
| 35 | + ```bash |
| 36 | + docker compose up -d |
| 37 | + ``` |
| 38 | + |
| 39 | + The Discord bot runs in the background. Slash commands sync within ~30 seconds. |
| 40 | + |
| 41 | +**Run a one-off sync (dry-run or active):** |
| 42 | + |
| 43 | +```bash |
| 44 | +docker compose run --rm bot --config /app/config/config.yaml run-once |
| 45 | +``` |
| 46 | +(Do not pass `ghdcbot` — the image entrypoint is already `ghdcbot`.) |
| 47 | + |
| 48 | +--- |
| 49 | + |
| 50 | +## Recommended Folder Structure |
| 51 | + |
| 52 | +``` |
| 53 | +Gitcord-GithubDiscordBot/ |
| 54 | +├── .env # Tokens (never commit; not in image) |
| 55 | +├── .env.example |
| 56 | +├── config/ |
| 57 | +│ ├── config.yaml # Your active config (data_dir: /data for Docker) |
| 58 | +│ ├── docker-example.yaml # Template for Docker |
| 59 | +│ └── example.yaml # Template for local install |
| 60 | +├── docker-compose.yml |
| 61 | +├── Dockerfile |
| 62 | +├── pyproject.toml |
| 63 | +├── src/ |
| 64 | +└── ... |
| 65 | +``` |
| 66 | + |
| 67 | +**Inside the container:** |
| 68 | + |
| 69 | +- `/app` = app root (code, config mount at `/app/config`). |
| 70 | +- `/data` = persistent volume (SQLite `state.db`, `reports/`, `audit_events.jsonl`). Set `data_dir: "/data"` in config. |
| 71 | + |
| 72 | +--- |
| 73 | + |
| 74 | +## Dockerfile Design (Why Each Part) |
| 75 | + |
| 76 | +| Section | Purpose | |
| 77 | +|--------|--------| |
| 78 | +| `FROM python:3.11-slim` | Matches `requires-python = ">=3.11"`; slim reduces image size and attack surface. | |
| 79 | +| `PYTHONDONTWRITEBYTECODE=1` | Avoids writing `.pyc` in the image; cleaner and slightly faster. | |
| 80 | +| `PYTHONUNBUFFERED=1` | Logs show up immediately in `docker compose logs`. | |
| 81 | +| Copy `pyproject.toml` + `src/` then `pip install -e .` | Dependency layer is cached; only code/setup changes trigger reinstall. | |
| 82 | +| `useradd appuser` / `USER appuser` | Process does not run as root. | |
| 83 | +| `ENTRYPOINT ["ghdcbot"]` | All invocations use the same binary; override with `run-once`, `bot`, etc. | |
| 84 | +| `CMD ["--config", "/app/config/config.yaml", "bot"]` | Default is Discord bot; overridden by `docker-compose` `command` or `docker run ... run-once`. | |
| 85 | + |
| 86 | +--- |
| 87 | + |
| 88 | +## docker-compose.yml Design |
| 89 | + |
| 90 | +| Section | Purpose | |
| 91 | +|--------|--------| |
| 92 | +| `env_file: .env` | Loads `GITHUB_TOKEN` and `DISCORD_TOKEN`; config YAML uses `${GITHUB_TOKEN}` etc. | |
| 93 | +| `./config:/app/config:ro` | Host config dir mounted read-only; edit YAML on host without rebuilding. | |
| 94 | +| `gitcord_data:/data` | Named volume for SQLite and reports; survives `docker compose down`. | |
| 95 | +| `command: ["--config", "/app/config/config.yaml", "bot"]` | Ensures config path is correct and default is bot. | |
| 96 | +| `restart: unless-stopped` | Bot comes back after reboot or Docker restart. | |
| 97 | + |
| 98 | +--- |
| 99 | + |
| 100 | +## Common Pitfalls and How to Avoid Them |
| 101 | + |
| 102 | +| Pitfall | Cause | Fix | |
| 103 | +|--------|--------|-----| |
| 104 | +| **"Config file does not exist"** | No `config/config.yaml` or wrong path. | Copy `config/docker-example.yaml` to `config/config.yaml` and keep `data_dir: "/data"`. | |
| 105 | +| **"Missing required environment variable: GITHUB_TOKEN"** | `.env` missing or not loaded. | Create `.env` in project root (same dir as `docker-compose.yml`) with `GITHUB_TOKEN` and `DISCORD_TOKEN`. | |
| 106 | +| **State lost after restart** | `data_dir` pointed at a non-persistent path. | Use `data_dir: "/data"` and the provided `docker-compose` volume; do not override `/data` with a host path unless you intend to. | |
| 107 | +| **Bot doesn’t respond / "application did not respond"** | Same as non-Docker: slow storage or missing intents. | Ensure Server Members Intent is enabled; check logs with `docker compose logs -f`. | |
| 108 | +| **Permission errors on `/data`** | Container user cannot write. | Dockerfile already runs as `appuser`; the volume is writable by the container. If you use a host bind mount for `data`, ensure the host dir is writable (e.g. `chown` to the same UID as `appuser`). | |
| 109 | +| **Running both bot and run-once** | Need two invocations. | Bot: `docker compose up -d`. Run-once: `docker compose run --rm bot ghdcbot --config /app/config/config.yaml run-once`. | |
| 110 | + |
| 111 | +--- |
| 112 | + |
| 113 | +## Audit-First Workflow in Docker |
| 114 | + |
| 115 | +1. Keep `runtime.mode: "dry-run"` in config. |
| 116 | +2. Run once: |
| 117 | + `docker compose run --rm bot --config /app/config/config.yaml run-once` |
| 118 | +3. Inspect reports in the volume (e.g. copy out or run a temporary container that mounts the same volume and cats the file): |
| 119 | + Reports are under `/data/reports/` (e.g. `audit.md`, `audit.json`). |
| 120 | +4. When satisfied, set `runtime.mode: "active"` and `discord.permissions.write: true` in config, then run `run-once` again or let the bot apply changes on the next sync. |
| 121 | + |
| 122 | +--- |
| 123 | + |
| 124 | +## Production and Maintainability Notes |
| 125 | + |
| 126 | +- **Reproducibility**: Same image and config produce the same behavior; use tagged images if you need to pin versions. |
| 127 | +- **Secrets**: Never bake tokens into the image; use `.env` or a secrets manager and `env_file` / env. |
| 128 | +- **Updates**: Rebuild with `docker compose build --no-cache` after dependency or code changes; config and data are unchanged. |
| 129 | +- **Logs**: Use `docker compose logs -f bot` for live logs; log level is controlled by config `runtime.log_level`. |
0 commit comments