Docker

Each release publishes ghcr.io/pwnera/artbucket, for amd64 and arm64, tagged with its version (such as 1.8.1), its minor line (1.8), its major (1) and latest. The registry lists the tags there are.

docker run -d --name artbucket -p 3000:3000 \
  -e DATABASE_URL=postgres://user:pass@db.example.com:5432/artbucket \
  -e S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com \
  -e S3_REGION=eu-central-1 \
  -e S3_BUCKET=acme-assets \
  -e S3_ACCESS_KEY_ID=... \
  -e S3_SECRET_ACCESS_KEY=... \
  -e S3_FORCE_PATH_STYLE=false \
  -e APP_URL=https://assets.example.com \
  -e BETTER_AUTH_SECRET="$(openssl rand -base64 32)" \
  ghcr.io/pwnera/artbucket:1

Keep BETTER_AUTH_SECRET somewhere safe: it signs sessions and encrypts secrets stored in settings. A new one signs everyone out and makes stored secrets unreadable.

Caution

Until the first account exists, whoever reaches the server can make it, and it is the admin of everything. Make it right away, or set SETUP_TOKEN (openssl rand -base64 24): the first-run form then asks for it.

The container:

• listens on port 3000 as the unprivileged node user
• migrates the database before it serves, under a lock, so several replicas can start at once
• runs the sweeper every six hours (deleted assets past 30 days, files nothing holds, and portal requests 90 days past their last use)
• includes ffmpeg for video thumbnails. For Word, Excel and PowerPoint previews, build on it: FROM ghcr.io/pwnera/artbucket:1, then USER root, RUN apk add --no-cache libreoffice, USER node.

Every variable is in Environment.

Building it yourself

docker build -t artbucket .