feat: add docker deploy #247
Conversation
WalkthroughSeveral configuration and infrastructure files were introduced or updated to support a multi-service application platform. These changes include new Docker and Maven configuration files, MySQL database schema and migration scripts, Nginx server configuration, and Spring Boot environment-specific YAML files. No code or API signatures were altered. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Nginx
participant Backend (tiny-engine-back)
participant MySQL
User->>Nginx: HTTP request (e.g., /index.html)
Nginx-->>User: Serve static file (if exists)
User->>Nginx: API request (e.g., /xxx-center/...)
Nginx->>Backend (tiny-engine-back): Proxy API request
Backend (tiny-engine-back)->>MySQL: Query/update data
MySQL-->>Backend (tiny-engine-back): DB response
Backend (tiny-engine-back)-->>Nginx: API response
Nginx-->>User: Return API response
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (8)
docker-deploy-data/mysql/init/update_all_tables_ddl.sql (1)
7-29: Masstenant_idNOT NULL → NULL change – audit application code & constraints
AllowingNULLtenant IDs across ~20 tables dramatically changes data-isolation guarantees. Ensure:
- Hibernate / MyBatis mappings don’t still have
@NotNull.- Foreign-key relations or unique indexes that previously included
tenant_idstill behave correctly with nullable columns.- Application logic that filters by
tenant_iddoesn’t assume non-null.Consider adding NOT-NULL + default tenant for records that truly have no tenant context instead of blanket NULL.
dockerfile (1)
3-3: Use COPY instead of ADD
ADDhas side-effects (automatic tar extraction & remote URL fetch) that are not needed for a simple context copy. Stick toCOPYfor predictability and to satisfy Hadolint DL3020.-ADD . . +COPY . .docker-deploy-data/nginx.conf (1)
14-14:server_name 0.0.0.0is invalid
Use_(catch-all) or an actual host/domain.0.0.0.0can break TLS SNI and log parsing.- server_name 0.0.0.0; + server_name _;app/src/main/resources/application-alpha (1)
57-65: Log file path may be unwritable in container
/logsnormally requires root or a mounted volume. Ensure the directory exists with correct permissions or point logging to STDOUT for Docker.docker-compose.yml (3)
13-16: Prefer named volumes over bind mounts for MySQL
Host-path binds tie data to the project directory and can cause UID/permission drift. Example:volumes: db-data: services: tiny-engine-data: volumes: - db-data:/var/lib/mysql
21-24: Use canonicalDockerfilename
Some build tools assumeDockerfile; renaming to lowercase may confuse them. If renaming is required, document it in README.
25-27:depends_onlacks health-checks
Startup order isn’t guaranteed; add healthcheck or wait-for-it script so the backend waits for MySQL readiness.docker-deploy-data/mysql/init/create_all_tables_ddl_v1.0.0.mysql.sql (1)
33-35: No foreign keys defined
Tables reference each other through*_idfields yet no FK constraints exist. This sacrifices referential integrity and cascades. Consider adding foreign keys or document why they’re intentionally omitted.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (10)
app/src/main/resources/application-alpha(1 hunks)app/src/main/resources/application-dev.yml(1 hunks)docker-compose.yml(1 hunks)docker-deploy-data/mysql/conf/my.cnf(1 hunks)docker-deploy-data/mysql/init/create_all_tables_ddl_v1.0.0.mysql.sql(1 hunks)docker-deploy-data/mysql/init/update_all_tables_ddl.sql(1 hunks)docker-deploy-data/mysql/init/update_tables_ddl_v1.0.0_2025_0527.sql(1 hunks)docker-deploy-data/nginx.conf(1 hunks)dockerfile(1 hunks)settings.xml(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
dockerfile
[HIGH] 4-4: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🪛 Hadolint (2.12.0)
dockerfile
[error] 3-3: Use COPY instead of ADD for files and folders
(DL3020)
🪛 YAMLlint (1.37.1)
docker-compose.yml
[error] 17-17: trailing spaces
(trailing-spaces)
[error] 25-25: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
[error] 38-38: trailing spaces
(trailing-spaces)
🔇 Additional comments (7)
settings.xml (1)
24-37: Mirror configuration looks good – Aliyun mirror is correctly scoped to*.app/src/main/resources/application-dev.yml (1)
5-8: Multipart limits added – LGTM
10MBis accepted by Spring Boot; property names are correct. Double-check that any reverse proxy (e.g., Nginx) and TomcatmaxSwallowSizelimits are ≥ 10 MB to avoid 413 errors.docker-deploy-data/mysql/init/update_tables_ddl_v1.0.0_2025_0527.sql (1)
1-2: Unique → non-unique index change may allow duplicate rows
Droppingu_idx_block_group(unique) and recreating it as a plainINDEXremoves the uniqueness constraint on (tenant_id,platform_id,name,app_id). If this was accidental, duplicates could creep in and break business logic.Confirm intent; otherwise use
ADD UNIQUE INDEX.docker-deploy-data/mysql/init/update_all_tables_ddl.sql (1)
1-6: Uniqueness dropped ont_component/t_datasource
Same pattern: unique indexes are recreated without theUNIQUEkeyword. Verify that the application truly no longer relies on uniqueness; else switch toADD UNIQUE INDEX.dockerfile (1)
15-16: Jar copy path likely wrong
/app/app/target/…adds an extraappdirectory (WORKDIR is already/app). Unless the build creates/app/app/target, this will fail at runtime.-COPY --from=build /app/app/target/tiny-engine-app-*.jar /app/tiny-engine-app.jar +COPY --from=build /app/target/tiny-engine-app-*.jar /app/tiny-engine-app.jarApply the same check for the base module path.
Likely an incorrect or invalid review comment.
docker-deploy-data/nginx.conf (1)
27-28: Inconsistentrootfor error pages
root html;conflicts with the earlier/usr/share/nginx/html. Usealiasor reuse the same root.app/src/main/resources/application-alpha (1)
28-30: Profile activation seems wrong
File is namedapplication-alphayeton-profile: devis set. This profile will never load unlessdevis active. Confirm intent.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
Dockerfile (2)
3-3: PreferCOPYoverADDfor predictable behaviour
ADD . .brings in tar-auto-extraction semantics you don’t need and triggers Hadolint DL3020. A straight file/folder copy is clearer.-ADD . . +COPY . .
18-19: Run as non-root for better container hardeningThe final image keeps the default root user. Consider creating an unprivileged user and dropping to it:
RUN useradd -r -u 1001 appuser USER appuserAlso move
EXPOSE 9090aboveENTRYPOINTfor readability (no functional impact).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 4-4: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🪛 Hadolint (2.12.0)
Dockerfile
[error] 3-3: Use COPY instead of ADD for files and folders
(DL3020)
🔇 Additional comments (1)
Dockerfile (1)
15-16: Wildcard copy may pick up multiple JARs – verify the result
tiny-engine-app-*.jar(and base) could match SNAPSHOT + test jars, leading to ambiguous or multiple copies. Ensure the package phase produces exactly one artefact, or copy via the full file name emitted by Maven (mvn -q -Dexpression=project.build.finalName …).
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (3)
Dockerfile (2)
4-8: Manual Maven download with--no-check-certificateis still insecure
Previous review already highlighted that disabling TLS validation (CKV2_DOCKER_3) opens the door to MITM attacks. Either:
- Replace the whole build stage with the official
maven:3.9.8-eclipse-temurin-17image, or- Keep the manual download but drop
--no-check-certificateand add checksum verification.This comment reiterates the unresolved critical security issue.
1-12: Re-use the official Maven image to collapse layers and improve cache hitsManually installing Maven duplicates what
maven:3.9.8-eclipse-temurin-17already provides, wastes ~100 MB, and complicates the Dockerfile. See earlier suggestion for the concise multi-stage pattern.docker-compose.yml (1)
9-10: Hard-coded MySQL root password persistsStoring credentials in-repo is insecure and violates secret-management best practices. Move
MYSQL_ROOT_PASSWORDto anenv_file, Docker secret, or CI-injected variable.
🧹 Nitpick comments (3)
Dockerfile (1)
3-3: Prefer COPY over ADD for context files
ADD . .triggers additional, rarely-needed behaviors (tar/remote URL handling) and is flagged by Hadolint DL3020. Switch toCOPYfor clarity and to avoid accidental surprises.-ADD . . +COPY . .docker-compose.yml (2)
13-16: Use named volumes instead of repo-relative host pathsMounting
./docker-deploy-data/mysql/...ties deployments to the repo layout and can cause permission clashes on different hosts. Define named volumes to improve portability and persist data across rebuilds:volumes: mysql-data: mysql-conf: mysql-init: mysql-logs: services: tiny-engine-data: ... volumes: - mysql-data:/var/lib/mysql - mysql-conf:/etc/mysql/conf.d - mysql-init:/docker-entrypoint-initdb.d - mysql-logs:/logs
17-38: Trailing whitespace—cosmetic but noisy in diffsLines 17, 25, 36 and 38 carry trailing spaces flagged by YAMLlint. Strip them to keep future diffs clean.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
Dockerfile(1 hunks)app/src/main/resources/application-alpha.yml(1 hunks)docker-compose.yml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- app/src/main/resources/application-alpha.yml
🧰 Additional context used
🪛 Checkov (3.2.334)
Dockerfile
[HIGH] 4-4: Ensure that certificate validation isn't disabled with wget
(CKV2_DOCKER_3)
🪛 Hadolint (2.12.0)
Dockerfile
[error] 3-3: Use COPY instead of ADD for files and folders
(DL3020)
🪛 YAMLlint (1.37.1)
docker-compose.yml
[error] 17-17: trailing spaces
(trailing-spaces)
[error] 25-25: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
[error] 38-38: trailing spaces
(trailing-spaces)
English | 简体中文
PR
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
Background and solution
What is the current behavior?
Issue Number: N/A
What is the new behavior?
Does this PR introduce a breaking change?
Other information
Summary by CodeRabbit
New Features
Configuration
Bug Fixes