syalioune/flowatch repository overview

⁠Flowatch — the OSS GUI for Flowable 7+

A single-page React GUI for Flowable 7+⁠ — the open-source BPMN/DMN process engine. Flowatch wraps the Flowable REST API and embeds the official bpmn-js⁠ and dmn-js⁠ modelers. The image is a static SPA bundle served by nginx — no Node, no JRE, no Flowable inside. Point it at any reachable Flowable backend from the Settings modal at runtime.

⁠Why this image exists

Flowable 6.x shipped a web UI (modeler + admin + task + IDM) with the OSS engine. Flowable removed it in 7.0 and kept the redesign enterprise-only. Flowatch fills that gap for OSS / public-sector / air-gapped / SME deployments — Flowable-aware down to the REST quirks (DMN sub-app prefix, missing /identity/tenants, multipart deployments).

Read more: github.com/syalioune/flowatch⁠.

⁠Quick start

docker run --rm -p 8081:8080 syalioune/flowatch:latest
# open http://localhost:8081 — set baseUrl in Settings to your Flowable engine

Default Flowable credentials (configurable in Settings, persisted to localStorage): rest-admin / test.

⁠Tags

Multi-arch: linux/amd64 + linux/arm64 on every tag.

A GHCR mirror is published in lock-step: ghcr.io/syalioune/flowatch:<tag>.

⁠Runtime characteristics

• Non-root: runs as uid 101 (nginx) on the unprivileged port 8080. Drops cleanly into Kubernetes restricted PodSecurity baselines; safe with all Linux capabilities dropped.
• Tiny: ~30 MB compressed. Idle footprint <50 m-cpu, <5 MB RAM.
• Stateless: no volumes, no config file. Connection settings live in the user's browser localStorage.
• Base images digest-pinned (node:22-alpine builder, nginxinc/nginx-unprivileged:alpine runtime). Dependabot bumps weekly; runtime stage runs apk -U upgrade on every build to pull in Alpine SecDB patches between pin bumps.

⁠Supply chain

Every image is built in GitHub Actions and ships with:

• SBOM — spdx-json, attached as an OCI attestation
• SLSA build provenance — attached as an OCI attestation
• OCI labels — org.opencontainers.image.{source,revision,version,licenses,…}
• Trivy scan — HIGH/CRITICAL block CI (allowlist in .trivyignore⁠)

Inspect:

docker buildx imagetools inspect syalioune/flowatch:latest \
  --format '{{ json .SBOM }}'

docker buildx imagetools inspect syalioune/flowatch:latest \
  --format '{{ json .Provenance }}'

⁠Verify against your Flowable

Tested end-to-end against flowable/flowable-rest:7.2.0. A full local stack (Postgres + Flowable + nginx CORS proxy + this SPA) is one command from the repo:

git clone https://github.com/syalioune/flowatch && cd flowatch
make stack

⁠Links

• Source & issues: https://github.com/syalioune/flowatch⁠
• Docs: project overview⁠ · architecture⁠ · deployment⁠ · compat matrix⁠
• License: Apache-2.0⁠
• Security policy: SECURITY.md⁠

⁠Status

Pre-alpha. Runs end-to-end against flowable-rest:7.2.0. Treat current behavior as a starting point — full project status in the GitHub README⁠.