Baton’s self-hosted worker: scheduled API runs, run history, and the git bridge for the web build.
135
The self-hosted companion service for Baton, the git-native API client: collections, environments, and schedules are plain YAML files in a git repository you own. The worker pulls that repository and:
schedules.yaml,
each in its own timezone, with run history and a failure webhook;Your server, your network, your credentials. There is no Baton cloud.
docker run -d --name baton-worker \
-p 8787:8787 \
-e BATON_WORKER_TOKEN=<long-random-token> \
-e BATON_GIT_URL=https://github.com/acme/my-apis.git \
-e BATON_GIT_TOKEN=<read-only-deploy-token> \
-e BATON_SECRET_APITOKEN=<value> \
-e TZ=UTC \
-v baton-data:/data \
{{IMAGE}}:latest
Then pair the app with the worker: its URL and the same token, kept in the operating system's secure storage.
| Variable | Purpose |
|---|---|
BATON_WORKER_TOKEN | The bearer token the app presents. Required: the worker refuses to start without it. |
BATON_GIT_URL | The workspace repository, pulled at start and every five minutes. |
BATON_GIT_TOKEN / BATON_GIT_USERNAME | A read-only deploy token for it, handed to git through a credential helper — never on a command line or in a log. |
BATON_SECRET_<NAME> | Values for the secret references requests use ({{name}}, {{secret:name}}). |
BATON_VAULT_TOKEN | A token for the workspace's HashiCorp Vault, for secrets kept there. |
BATON_DATA_DIR | /data by default: the SQLite run history and the workspace checkout. |
BATON_HISTORY_RETENTION_DAYS | 90 by default; 0 keeps every run. |
BATON_PORT | 8787 by default. |
BATON_WORKER_PUBLIC_EGRESS_ONLY | true sends every request the worker makes to public addresses only. |
BATON_WORKER_EGRESS_ALLOW | With the above: exact origins that stay reachable, comma-separated. |
Run history keeps statuses, durations, and sizes, never request or response bodies, and secrets are masked by value in every report.
docker run --rm -v "$PWD:/data/workspace" -e BATON_SECRET_APITOKEN \
{{IMAGE}} run --workspace /data/workspace --environment staging
--collection, --reporter text|json|junit, --output, and
--allow-failure narrow and shape the run. The exit code is 0 when every
request passed, 1 when one failed, and 2 for a bad argument.
| Port | 8787/tcp, plain HTTP — put Caddy, nginx, or Traefik in front for TLS |
| Volume | /data |
| Platforms | linux/amd64, linux/arm64 |
| Tags | the worker's version (0.2.3) and latest |
| Same image | ghcr.io/dudko-dev/baton-worker |
| Without Docker | npx -y @dudko.dev/baton-worker on Node.js 24+ with git |
Proprietary. Free for personal, non-commercial use. Commercial use is free for small entities: your group must have raised less than USD 250,000 in total, be valued at less than USD 250,000, and have annual gross revenue under USD 1,000,000. Above any of the three, commercial use needs a license — write to [email protected].
Redistribution is not permitted. Pulling this image, caching it in your own registry proxy, and building your own deployment images are fine; republishing it or bundling it into something you ship is not.
Documentation ships inside the Baton app and lives at baton.dudko.dev.
Content type
Image
Digest
sha256:08cc0ea26…
Size
118.6 MB
Last updated
about 1 month ago
docker pull sergdudko/baton-worker