KNetraHub UI: server-side rendering, client bundle and API proxy. No database.
1.3K
UI ā the only service the browser talks to.
KNetraHub is a self-hosted IT operations portal: a Docker Swarm console, full-stack monitoring, work management, privileged access management, IP address management and a database workspace, behind one sign-in. It ships two ways ā as a single monolith image, or as the split stack of one image per service that this image belongs to.
š Documentation: https://sengphirum.github.io/KNetraHub/documentationā
Server-side rendering, the client bundle and the API proxy. Owns no business API, no database connection, no migrations and no background job ā a UI deploy can only ever affect the UI.
Renders pages server-side, serves the hashed client bundle, and forwards every /api/** call to the service that owns that path, using the route table in the topology rather than a hand-written proxy map. The WebSocket relay for PAM sessions passes through the same way.
It holds no database credentials, applies no migration and runs no job ā by construction, not by configuration. A UI deploy cannot change data or interrupt a queue, which is the entire reason it is a separate image.
Runs unprivileged with cap_drop: [ALL] and nothing added back, and with no database credentials at all.
| Image | Serves HTTP | Runs background jobs | Scale it with |
|---|---|---|---|
knetrahub-ui (this image) | yes | no | request load |
knetrahub-appā | yes | yes | nothing ā it is one process |
Every split stack needs exactly one of these. Scale it with page traffic, not with API load.
Read straight from the stack file that deploys this service, so the list is what the image actually takes. Optional entries ship commented out.
| Variable | Default | |
|---|---|---|
NUXT_PUBLIC_APP_NAME | KNetraHub | optional |
NUXT_PUBLIC_APP_URL | https://knetrahub.example.com | optional |
KNETRA_SERVICE_URL_TEMPLATE | http://{service}:3000 | optional |
KNETRA_INTERNAL_TOKEN_FILE | /run/secrets/knetrahub_internal_token | optional |
KNETRA_PROXY_TIMEOUT_MS | 120000 | optional |
Anything ending in _FILE reads its value from that path instead, which is how the stack passes Docker secrets.
This is one service of a stack, not a standalone container: it expects the portal database and its siblings on the same overlay network. Deploy it with the stack file that owns it rather than with docker run.
docker stack deploy -c docker/docker-compose.yml knetrahub
Pin a tag or a registry for this one service with KNETRAHUB_UI_IMAGE, which the stack file reads:
export KNETRAHUB_UI_IMAGE=phirumseng/knetrahub-ui:0.1.11
latest ā the most recent releasex.y.z (e.g. 0.1.11) ā immutable release versionsPin the version in production. A rollback needs a tag that does not move, and every image in the stack is released under the same version so the whole set can be pinned together.
Each service is its own image, so one can be updated without restarting the others:
phirumseng/knetrahub-appā ā Monolith (app)phirumseng/knetrahub-ui ā UI ā this imagephirumseng/knetrahub-core-apiā ā Core APIphirumseng/knetrahub-docker-apiā ā Docker APIphirumseng/knetrahub-docker-workerā ā Docker workerphirumseng/knetrahub-monitoring-apiā ā Monitoring APIphirumseng/knetrahub-monitoring-workerā ā Monitoring workerphirumseng/knetrahub-work-apiā ā Work APIphirumseng/knetrahub-work-workerā ā Work workerphirumseng/knetrahub-pam-apiā ā Privileged Access APIphirumseng/knetrahub-pam-workerā ā Privileged Access workerphirumseng/knetrahub-ipmgt-apiā ā IP Management APIphirumseng/knetrahub-ipmgt-workerā ā IP Management workerphirumseng/knetrahub-dbmanager-apiā ā Database Manager APIphirumseng/knetrahub-agentā ā node agentphirumseng/knetrahub-pam-ssh-gatewayā ā PAM SSH gatewayphirumseng/knetrahub-pam-connector-runnerā ā PAM connector runnerphirumseng/knetrahub-dbmanager-gatewayā ā DB Manager gatewayProprietary ā Ā© Seng Phirum. All rights reserved.
Content type
Image
Digest
sha256:8591a1f76ā¦
Size
74.3 MB
Last updated
2 days ago
docker pull phirumseng/knetrahub-ui