Add Docker Compose development environment #111

rayhatfield · 2026-01-17T18:44:32Z

Dockerize the application with services for nginx, PHP-FPM, MySQL 8, Redis, realtime (Node.js), and cron jobs. This provides a modern alternative to the Vagrant-based setup.

Changes:

Add docker-compose.yml and docker-compose.prod.yml
Add Dockerfiles and configs in services/ for each component
Add dev-setup.sh script for SSL cert generation and directory setup
Add .env.example for environment configuration
Add .config.docker for Docker-specific app settings
Update realtime/app.js to support configurable Redis host
Update mysqlConnectionInfo.inc to support configurable Redis host
Fix MySQL 8 strict mode compatibility issues:
- Add DEFAULT 0 to nsfw column in offensive_uploads schema
- Use NULL instead of empty string for vote column in comments
Update README with Docker setup instructions

Notes:

I'd taken a run at this previously. This version is mostly via Claude.
search doesn't work in the container because Xapian is not installed.

Dockerize the application with services for nginx, PHP-FPM, MySQL 8, Redis, realtime (Node.js), and cron jobs. This provides a modern alternative to the Vagrant-based setup. Changes: - Add docker-compose.yml and docker-compose.prod.yml - Add Dockerfiles and configs in services/ for each component - Add dev-setup.sh script for SSL cert generation and directory setup - Add .env.example for environment configuration - Add .config.docker for Docker-specific app settings - Update realtime/app.js to support configurable Redis host - Update mysqlConnectionInfo.inc to support configurable Redis host - Update README with Docker setup instructions

- Add DEFAULT 0 to nsfw column in offensive_uploads schema - Use NULL instead of empty string for vote column in comments MySQL 8's strict mode rejects missing defaults for NOT NULL columns and empty strings for ENUM columns.

Copilot

Pull request overview

This PR introduces a Docker Compose-based development environment as a modern alternative to the existing Vagrant setup. It containerizes the application with services for nginx, PHP-FPM, MySQL 8, Redis, Node.js realtime WebSocket server, and cron jobs.

Changes:

Added Docker Compose configuration files for development and production environments
Created service-specific Dockerfiles and configuration files for nginx, PHP, realtime, and cron services
Updated application code for MySQL 8 compatibility and configurable Redis host
Added development setup script for SSL certificate generation
Updated documentation with Docker setup instructions

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 24 comments.

Show a summary per file

File	Description
docker-compose.yml	Main orchestration file defining all services, volumes, and networks
docker-compose.prod.yml	Production overrides for restart policies and volume management
services/nginx/Dockerfile	Nginx web server container configuration
services/nginx/nginx.conf	Main nginx configuration
services/nginx/tmbo.conf	Application-specific nginx virtual host configuration
services/php/Dockerfile	PHP-FPM 5.6 container setup
services/php/php.ini	PHP runtime configuration
services/php/www.conf	PHP-FPM pool configuration
services/realtime/Dockerfile	Node.js 14 container for WebSocket server
services/cron/Dockerfile	Cron service container for scheduled tasks
services/cron/crontab	Cron job definitions
scripts/dev-setup.sh	Setup script for SSL certificates and directories
realtime/app.js	Updated with configurable Redis host support
realtime/package.json	Updated mysql package version
admin/mysqlConnectionInfo.inc	Added configurable Redis host
offensive/assets/core.inc	MySQL 8 strict mode compatibility fix
admin/database/schema.sql	Added DEFAULT 0 to nsfw column
admin/.config.docker	Docker-specific configuration file
.env.example	Environment variable template
README.md	Added Docker setup instructions
.gitignore	Added Docker-generated directories

Comments suppressed due to low confidence (1)

realtime/app.js:12

The use of eval() on line 12 in the checkIniString function is a security risk. Even though the input comes from a configuration file, using eval() can execute arbitrary code. Consider using JSON.parse() or a safer alternative to handle quoted strings.

function checkIniString(data) {
  if (/^("|').*("|')$/.test(data))
    return eval(data);

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-17T18:50:07Z

scripts/dev-setup.sh

+mkdir -p "$PROJECT_ROOT/services/web/src/offensive/uploads"
+mkdir -p "$PROJECT_ROOT/services/web/src/offensive/zips"
+mkdir -p "$PROJECT_ROOT/services/web/src/offensive/quarantine"


The script references paths like 'services/web/src/offensive/uploads' but these directories may not exist in the repository structure. Verify that these paths are correct and align with the actual project structure or document that they will be created by the application.

Copilot · 2026-01-17T18:50:07Z

admin/.config.docker

+[tmbo]
+database_host = "db"
+database_user = "tmbo"
+database_pass = "shortbus"


The database password 'shortbus' is hardcoded in the configuration file. While this is acceptable for development, ensure this file is never used in production environments. Consider adding a comment in the file itself warning against production use.

Copilot · 2026-01-17T18:50:08Z

services/realtime/Dockerfile

+ENV NODE_ENV=production
+


The NODE_ENV is set to 'production' in the Dockerfile but the docker-compose.yml overrides it to 'development' (line 94). Consider removing this default from the Dockerfile to avoid confusion and let the docker-compose file control the environment setting.

Suggested change

ENV NODE_ENV=production

Copilot · 2026-01-17T18:50:08Z

services/php/php.ini

@@ -0,0 +1,117 @@
+[PHP]
+engine = On
+short_open_tag = On


The 'short_open_tag' setting is enabled, which allows PHP code to use the <? opening tag instead of <?php. This feature is deprecated and may be removed in future PHP versions. Consider setting this to 'Off' and updating code to use the standard <?php tag for better compatibility.

Suggested change

short_open_tag = On

short_open_tag = Off

Copilot · 2026-01-17T18:50:08Z

services/php/php.ini

+disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,
+disable_classes =
+zend.enable_gc = On
+expose_php = On


The 'expose_php' setting is enabled, which sends the PHP version in HTTP response headers. This exposes information about the server stack that could be used by attackers. Consider setting this to 'Off' for better security through obscurity.

Suggested change

expose_php = On

expose_php = Off

Copilot · 2026-01-17T18:50:12Z

services/realtime/Dockerfile

@@ -0,0 +1,21 @@
+FROM node:14-alpine


Node.js 14 reached end-of-life on April 30, 2023. Consider upgrading to a supported LTS version such as Node.js 18 or 20 for security updates and long-term support.

Suggested change

FROM node:14-alpine

FROM node:20-alpine

Copilot · 2026-01-17T18:50:12Z

services/php/php.ini

+display_errors = On
+display_startup_errors = On


Display errors are enabled in production. The 'display_errors' and 'display_startup_errors' settings should be set to 'Off' in production environments to prevent sensitive information from being exposed to users. Error details should only be logged, not displayed.

Suggested change

display_errors = On

display_startup_errors = On

display_errors = Off

display_startup_errors = Off

Copilot · 2026-01-17T18:50:12Z

services/php/php.ini

+session.hash_function = 0
+session.hash_bits_per_character = 5


The session.hash_function and session.hash_bits_per_character settings are deprecated as of PHP 7.1 and removed in PHP 7.2+. While this won't affect PHP 5.6, consider removing these lines for future compatibility.

Suggested change

session.hash_function = 0

session.hash_bits_per_character = 5

Copilot · 2026-01-17T18:50:13Z

services/nginx/tmbo.conf

+
+    root /var/www/html;
+


The nginx configuration lacks a 'server_name' directive. In production, this should be set to the actual domain name to ensure proper virtual host routing and prevent potential host header injection attacks.

Suggested change

root /var/www/html;

# TODO: Replace "_" with the actual domain name in production, e.g. "example.com".

server_name _;

Copilot · 2026-01-17T18:50:13Z

docker-compose.yml

+    networks:
+      - tmbo-network
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-pshortbus"]


The healthcheck command includes the MySQL root password in plain text ('-pshortbus'). While this is within a container environment, it's still a security risk as the password appears in process listings. Consider using a .my.cnf file or the MYSQL_PWD environment variable for healthchecks.

rayhatfield added 2 commits January 17, 2026 12:22

Fix MySQL 8 strict mode compatibility issues

dc94a5b

- Add DEFAULT 0 to nsfw column in offensive_uploads schema - Use NULL instead of empty string for vote column in comments MySQL 8's strict mode rejects missing defaults for NOT NULL columns and empty strings for ENUM columns.

rayhatfield requested a review from Copilot January 17, 2026 18:44

Copilot started reviewing on behalf of rayhatfield January 17, 2026 18:45 View session

Copilot AI reviewed Jan 17, 2026

View reviewed changes

rayhatfield requested review from jaswope and numist January 17, 2026 19:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Docker Compose development environment #111

Add Docker Compose development environment #111

Uh oh!

rayhatfield commented Jan 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Copilot AI Jan 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		session.hash_function = 0
		session.hash_bits_per_character = 5

-    root /var/www/html;
+    # TODO: Replace "_" with the actual domain name in production, e.g. "example.com".
+    server_name _;

Add Docker Compose development environment #111

Are you sure you want to change the base?

Add Docker Compose development environment #111

Uh oh!

Conversation

rayhatfield commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rayhatfield commented Jan 17, 2026 •

edited

Loading