phirumseng/knetrahub-work-worker repository overview

⁠phirumseng/knetrahub-work-worker

Work worker — the background half of Work.

KNetraHub is a self-hosted IT operations portal: a Docker Swarm console, full-stack monitoring, work management, privileged access management, IP address management and a database workspace, behind one sign-in. It ships two ways — as a single monolith image, or as the split stack of one image per service that this image belongs to.

📖 Documentation: https://sengphirum.github.io/KNetraHub/documentation⁠

⁠What this image does

Durable Work job queue: reminders, automations, recurring tasks, ClickUp import/delta sync, attachment scanning.

It bundles the server code of work and nothing else, so the image carries only the module it is named after.

⁠How it works

Runs no HTTP listener at all. It claims work from a durable queue with FOR UPDATE SKIP LOCKED and, for the jobs that must run once cluster-wide, a lease that one replica holds at a time — so replicas cooperate instead of duplicating. On SIGTERM it stops claiming, finishes what it already holds and hands the rest back to the queue, which is why its stop_grace_period is generous.

⁠What it deliberately does not do

The ingress never routes to it and it answers no request. Losing it delays work; it does not fail a page load.

⁠Privileges

Runs unprivileged with cap_drop: [ALL] and nothing added back.

⁠Which image do I want

Scale this with job volume. The matching work-api image handles the requests, and the two scale on completely different signals.

⁠Settings

Read straight from the stack file that deploys this service, so the list is what the image actually takes. Optional entries ship commented out.

Anything ending in _FILE reads its value from that path instead, which is how the stack passes Docker secrets.

⁠Deploying it

This is one service of a stack, not a standalone container: it expects the portal database and its siblings on the same overlay network. Deploy it with the stack file that owns it rather than with docker run.

docker stack deploy -c docker/docker-compose.yml knetrahub

Pin a tag or a registry for this one service with KNETRAHUB_WORK_WORKER_IMAGE, which the stack file reads:

export KNETRAHUB_WORK_WORKER_IMAGE=phirumseng/knetrahub-work-worker:0.1.11

⁠Supported tags

• latest — the most recent release
• x.y.z (e.g. 0.1.11) — immutable release versions

Pin the version in production. A rollback needs a tag that does not move, and every image in the stack is released under the same version so the whole set can be pinned together.

⁠The rest of the stack

Each service is its own image, so one can be updated without restarting the others:

• phirumseng/knetrahub-app⁠ — Monolith (app)
• phirumseng/knetrahub-ui⁠ — UI
• phirumseng/knetrahub-core-api⁠ — Core API
• phirumseng/knetrahub-docker-api⁠ — Docker API
• phirumseng/knetrahub-docker-worker⁠ — Docker worker
• phirumseng/knetrahub-monitoring-api⁠ — Monitoring API
• phirumseng/knetrahub-monitoring-worker⁠ — Monitoring worker
• phirumseng/knetrahub-work-api⁠ — Work API
• phirumseng/knetrahub-work-worker — Work worker ← this image
• phirumseng/knetrahub-pam-api⁠ — Privileged Access API
• phirumseng/knetrahub-pam-worker⁠ — Privileged Access worker
• phirumseng/knetrahub-ipmgt-api⁠ — IP Management API
• phirumseng/knetrahub-ipmgt-worker⁠ — IP Management worker
• phirumseng/knetrahub-dbmanager-api⁠ — Database Manager API
• phirumseng/knetrahub-agent⁠ — node agent
• phirumseng/knetrahub-pam-ssh-gateway⁠ — PAM SSH gateway
• phirumseng/knetrahub-pam-connector-runner⁠ — PAM connector runner
• phirumseng/knetrahub-dbmanager-gateway⁠ — DB Manager gateway

⁠License

Proprietary — © Seng Phirum. All rights reserved.