tiennm99
24cefe80a2
Diun needs the Docker API to enumerate containers and inspect each one's image. Mounting the socket into it directly is host-root-equivalent, and :ro on a socket mount is cosmetic, so the socket goes into a docker-socket-proxy sidecar and Diun reaches it at tcp://dockerproxy:2375. POST is revoked there, so container create and exec return 403. CONTAINERS and IMAGES are both required: with CONTAINERS alone the provider loads and enumerates containers, then every ImageInspect returns 403 and nothing is analysed. Verified against a live watch cycle — 25 images analysed, no errors. Pin crazymax/diun:4.33 rather than :latest, since this is the service whose job is to talk to the daemon.
composes
My docker compose collection — one directory per service, each self-contained. Tuned to my own setup rather than written as general-purpose templates.
Services are deployed through Coolify and Dokploy, which own what a standalone compose file would otherwise declare:
- No published ports. The platform attaches the container to its proxy network and maps a domain to the internal port. Publishing one would also expose it on the host.
- No
restart:policy. The platform manages the container lifecycle. - No
container_name:. Compose derives it from the directory.
Services that do publish ports or set restart: say so in their own README.
Layout
<service>/
compose.yml # the service definition
README.md # what it is, its variables, how it's wired
.env.example # required variables, committed
.env # real values, gitignored
Compose names the project after its directory, so code-server/ comes up as
the code-server project with its own network and volumes.
Usage
In Coolify or Dokploy, point a Docker Compose resource at the service directory
and set the environment variables from its .env.example.
Locally:
cd <service>
cp .env.example .env # then fill it in
docker compose up -d
docker compose logs -f
docker compose down
.env is picked up automatically because it sits next to compose.yml. Never
commit it — the root .gitignore covers .env/*.env and re-includes
.env.example.
Services
Each links to its own README for variables, ports, and storage.
| Service | What it is |
|---|---|
| alloy | Grafana Alloy shipping host and Docker telemetry to Grafana Cloud |
| code-server | VS Code in the browser, as a remote dev box |
| couchbase | Couchbase Server |
| diun | Image-update notifier, reading the Docker API through a read-only proxy |
| gitea-mirror | Gitea + PostgreSQL + gitea-mirror, mirroring GitHub repos |
| opencode-web | opencode coding agent, served as a browser UI |
| openhands | OpenHands coding agent, running each session in a container it spawns |
| paseo | Paseo coding-agent daemon and web UI |
| traffmonetizer | TraffMonetizer bandwidth-sharing client |
Licensed under Apache 2.0 — see LICENSE.