Skip to content

Docker: OCI labels, hermetic build context, README self-host section #1038

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wass08 merged 1 commit into from
Oct 12, 2026
+32 −0
Merged

Docker: OCI labels, hermetic build context, README self-host section #1038

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,5 @@ node_modules
.env.local
.env*.local
*.log
*.tsbuildinfo
**/*.tsbuildinfo
3 changes: 3 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,6 +421,9 @@ jobs:
with:
context: .
platforms: linux/${{ matrix.arch }}
labels: |
org.opencontainers.image.version=${{ needs.release.outputs.version }}
org.opencontainers.image.revision=${{ github.sha }}

@cursor cursor Bot Oct 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Revision label uses trigger SHA

Medium Severity

The org.opencontainers.image.revision label records github.sha, the workflow_dispatch commit, while the image is built from the @pascal-app/cli@* tag checkout. Those commits diverge whenever the release job writes a version-bump commit, and a none republish can label an unrelated later main SHA.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d0f798d. Configure here.

outputs: type=image,name=ghcr.io/pascalorg/pascal-editor,push-by-digest=true,name-canonical=true,push=true

- run: |
Expand Down
10 changes: 10 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,16 @@ RUN cd packages/cli && bun run build && bun run stage-runtime

FROM node:22-alpine
WORKDIR /app

# GHCR reads these: the package page links to the repository, shows its
# README and inherits its access, and the licence is declared on the image.
LABEL org.opencontainers.image.title="Pascal editor" \
org.opencontainers.image.description="Self-hosted Pascal, the open-source 3D architecture editor: one container, projects in SQLite under /data." \
org.opencontainers.image.source="https://github.com/pascalorg/editor" \
org.opencontainers.image.documentation="https://github.com/pascalorg/editor/blob/main/SETUP.md" \
org.opencontainers.image.url="https://editor.pascal.app" \
org.opencontainers.image.vendor="Pascal" \
org.opencontainers.image.licenses="MIT"
ENV NODE_ENV=production \
HOSTNAME=0.0.0.0 \
PORT=3000 \
Expand Down
17 changes: 17 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,23 @@ troubleshooting.

Use one active agent client per local CLI service. The standalone local HTTP runtime shares active scene state between clients; use separate `PASCAL_HOME` directories and service processes when independent concurrent work is required.

## Self-host it

The editor ships as one container, `ghcr.io/pascalorg/pascal-editor`, tagged with the
same version as the npm packages (`latest` follows stable releases). Projects live in
SQLite under `/data`; one admin password protects the instance; `PASCAL_PUBLIC_URL` is
read at runtime, so the same image serves any domain.

```bash
docker run -d -p 3000:3000 -v pascal-data:/data \
-e PASCAL_ADMIN_PASSWORD=change-me \
-e PASCAL_PUBLIC_URL=https://pascal.example.com \
ghcr.io/pascalorg/pascal-editor:latest
```

See [SETUP.md, "Self-hosting"](SETUP.md#self-hosting) for the compose file, the
variables, agent access and public embeds.

## Agent skills

[![Install with skills](https://skills.sh/b/pascalorg/editor)](https://skills.sh/pascalorg/editor)
Expand Down
Loading