Dockerfile

# Heimdall for Cloudron
#
# Single-process app: Apache + libapache2-mod-php serves Heimdall (Laravel)
# directly on port 3000. Persistent state under /app/data, ephemeral
# bootstrap cache under /run.
#
# Cloudron filesystem layout (cheat-sheet):
#   /app/code      read-only application code (this image)
#   /app/data      writable, persistent, backed up (localstorage addon)
#   /run, /tmp     writable, NOT persistent

FROM cloudron/base:5.0.0@sha256:04fd70dbd8ad6149c19de39e35718e024417c3e01dc9c6637eaf4a41ec4e596c

ARG HEIMDALL_VERSION=v2.6.1

# ---------------------------------------------------------------------------
# System dependencies: Apache + PHP 8.3 + extensions Heimdall needs
# ---------------------------------------------------------------------------
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        ca-certificates curl git unzip \
        apache2 libapache2-mod-php8.3 \
        php8.3-cli php8.3-sqlite3 php8.3-mbstring php8.3-xml \
        php8.3-curl php8.3-zip php8.3-gd php8.3-bcmath php8.3-intl \
        php8.3-tokenizer php8.3-fileinfo && \
    curl -fsSL https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------------------
# Fetch upstream source at the pinned tag
# ---------------------------------------------------------------------------
RUN mkdir -p /app/code && \
    git clone --depth 1 --branch "${HEIMDALL_VERSION}" \
        https://github.com/linuxserver/Heimdall.git /app/code/upstream && \
    rm -rf /app/code/upstream/.git

WORKDIR /app/code/upstream

# ---------------------------------------------------------------------------
# Composer install (production deps only, optimised autoloader).
#
# --no-scripts is critical: composer would otherwise run
# `php artisan package:discover` as a post-autoload-dump hook, which
# boots Laravel and tries to connect to the database. Heimdall's
# .env.example defaults to DB_CONNECTION=mysql, and AppServiceProvider
# issues a schema query at boot — both blow up inside an empty build
# container. Instead, package:discover runs at container start (start.sh)
# against the real SQLite DB and the actual /app/data/.env.
# ---------------------------------------------------------------------------
RUN composer install --no-dev --optimize-autoloader --no-scripts --no-progress --no-interaction && \
    composer clear-cache

# ---------------------------------------------------------------------------
# Read-only filesystem fixups.
#
# Laravel writes under storage/, bootstrap/cache/, the SQLite DB, and the
# .env file. /app/code is read-only on Cloudron, so all four targets must
# be symlinks baked into the image. Persistent state goes to /app/data,
# ephemeral cache goes to /run.
#
# public/storage is the Laravel storage:link symlink (public/storage →
# storage/app/public/) and is created here at build time so we never
# need to run `php artisan storage:link` against a read-only fs.
# ---------------------------------------------------------------------------
RUN rm -rf /app/code/upstream/storage \
           /app/code/upstream/bootstrap/cache \
           /app/code/upstream/database/database.sqlite \
           /app/code/upstream/.env \
           /app/code/upstream/public/storage && \
    ln -s /app/data/storage /app/code/upstream/storage && \
    ln -s /run/heimdall/bootstrap-cache /app/code/upstream/bootstrap/cache && \
    ln -s /app/data/database.sqlite /app/code/upstream/database/database.sqlite && \
    ln -s /app/data/.env /app/code/upstream/.env && \
    ln -s /app/data/storage/app/public /app/code/upstream/public/storage && \
    # Heimdall's config/view.php lists app/SupportedApps/ as a view path.
    # Upstream moved its supported-apps catalogue out to a separate repo
    # (linuxserver/Heimdall-Apps), so the directory is empty in our build.
    # `view:cache` walks all view paths and bails on missing directories,
    # so create an empty one to keep it happy.
    mkdir -p /app/code/upstream/app/SupportedApps

# ---------------------------------------------------------------------------
# Apache configuration: single VHost on :3000, document root in upstream/public
# ---------------------------------------------------------------------------
COPY apache2.conf /etc/apache2/sites-available/heimdall.conf
RUN a2dissite 000-default && \
    a2ensite heimdall && \
    a2enmod rewrite headers && \
    sed -i 's/^Listen 80$/Listen 3000/' /etc/apache2/ports.conf && \
    sed -i '/^Listen 443/d' /etc/apache2/ports.conf && \
    # Apache must run as the cloudron user so it can read /app/data
    sed -i 's/^export APACHE_RUN_USER=.*/export APACHE_RUN_USER=cloudron/' /etc/apache2/envvars && \
    sed -i 's/^export APACHE_RUN_GROUP=.*/export APACHE_RUN_GROUP=cloudron/' /etc/apache2/envvars && \
    # Apache pid/lock/log dirs must be writable; redirect to /run
    sed -i 's|^export APACHE_PID_FILE=.*|export APACHE_PID_FILE=/run/apache2/apache2.pid|' /etc/apache2/envvars && \
    sed -i 's|^export APACHE_RUN_DIR=.*|export APACHE_RUN_DIR=/run/apache2|' /etc/apache2/envvars && \
    sed -i 's|^export APACHE_LOCK_DIR=.*|export APACHE_LOCK_DIR=/run/apache2|' /etc/apache2/envvars && \
    sed -i 's|^export APACHE_LOG_DIR=.*|export APACHE_LOG_DIR=/run/apache2|' /etc/apache2/envvars

# ---------------------------------------------------------------------------
# Cloudron-specific glue
# ---------------------------------------------------------------------------
COPY start.sh /app/code/start.sh
RUN chmod +x /app/code/start.sh

# Pre-create runtime dirs Apache and Laravel want under /run
RUN mkdir -p /run/apache2 /run/heimdall/bootstrap-cache

EXPOSE 3000

CMD ["/app/code/start.sh"]