Docker

A Docker Compose contour is the usual delivery for a single host or a small VM. The vendor provides the compose files, images, and an environment template. There is no public clone URL.

Start and stop

Use the compose file and project name from the delivery runbook. Typical operator commands look like this (file names may differ):

docker compose -f docker-compose.prod.yml up -d
docker compose -f docker-compose.prod.yml ps
docker compose -f docker-compose.prod.yml logs -f
docker compose -f docker-compose.prod.yml down

The application is usually reached through the reverse proxy on HTTPS, not by publishing port 3000 on the host.

Environment

Secrets and public URLs are set in the .env the vendor leaves on the host. Example shape — replace hostnames with the customer's domain:

DATABASE_URL=postgresql://postgres:postgres@db:5432/pailot
BETTER_AUTH_SECRET=<provided>
ENCRYPTION_KEY=<provided>
INTERNAL_API_SECRET=<provided>
NEXT_PUBLIC_APP_URL=https://pailot.yourdomain.com
BETTER_AUTH_URL=https://pailot.yourdomain.com
NEXT_PUBLIC_SOCKET_URL=https://pailot.yourdomain.com

See Environment Variables for the full list.

TLS termination

Traffic should terminate at Caddy or Nginx in front of the app (port 3000) and the realtime service (port 3002). Example host: pailot.yourdomain.com.

pailot.yourdomain.com {
    reverse_proxy localhost:3000

    handle /socket.io/* {
        reverse_proxy localhost:3002
    }
}

server {
    listen 443 ssl;
    server_name pailot.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /socket.io/ {
        proxy_pass http://127.0.0.1:3002;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Point the DNS A record at the contour host. Certificate issuance is part of the install runbook.

Local models (Ollama)

If the contour includes Ollama, the vendor sets OLLAMA_URL. From inside Docker, localhost is the container, not the host.

# Ollama on the same host as Docker Desktop / macOS
OLLAMA_URL=http://host.docker.internal:11434

# Ollama on a Linux host — use that host's address
OLLAMA_URL=http://192.168.1.100:11434

Backup

Dump PostgreSQL with the user and database name from the delivery (often the db service):

docker compose -f docker-compose.prod.yml exec db pg_dump -U postgres pailot > backup.sql

Keep the dump off the application host. Restore steps are in the runbook.

Updates

The vendor ships image tags and a migrate step. Do not docker compose pull from a public registry unless the runbook says those images are yours to pull.