wonderfall/mastodon
Your self-hosted, globally interconnected microblogging community.
Mastodon official website and source code.
Why this image?
This non-official image is intended as an all-in-one (as in monolithic) Mastodon production image. You should use the official image for development purpose or if you want scalability.
Security
Don't run random images from random dudes on the Internet. Ideally, you want to maintain and build it yourself.
Images are scanned every day by Trivy for OS vulnerabilities. They are rebuilt once a week, so you should often update your images regardless of your Mastodon version.
Features
- Rootless image
- Based on Alpine Linux
- Includes hardened_malloc
- Precompiled assets for Mastodon
Tags
latest: latest Mastodon version (or working commit)x.x: latest Mastodon x.x (e.g.3.4)x.x.x: Mastodon x.x.x (including release candidates)
You can always have a glance here.
Build-time variables
| Variable | Description | Default |
|---|---|---|
| MASTODON_VERSION | version/commit of Mastodon | N/A |
| REPOSITORY | source of Mastodon | tootsuite/mastodon |
Environment variables you should change
| Variable | Description | Default |
|---|---|---|
| UID | user id (rebuild to change) | 991 |
| GID | group id (rebuild to change) | 991 |
| RUN_DB_MIGRATIONS | run migrations at startup | true |
| SIDEKIQ_WORKERS | number of Sidekiq workers | 5 |
Don't forget to provide an environment file for Mastodon itself.
Volumes
| Variable | Description |
|---|---|
| /mastodon/public/system | data files |
| /mastodon/log | logs |
Ports
| Port | Use |
|---|---|
| 3000 | Mastodon web |
| 4000 | Mastodon streaming |
docker-compose example
Please use your own settings and adjust this example to your needs. Here I use Traefik v2 (already configured to redirect 80 to 443 globally).
version: '2.4'
networks:
http_network:
external: true
mastodon_network:
external: false
internal: true
services:
mastodon:
image: ghcr.io/wonderfall/mastodon
container_name: mastodon
restart: unless-stopped
security_opt:
- no-new-privileges:true
env_file: /wherever/docker/mastodon/.env.production
depends_on:
- mastodon-db
- mastodon-redis
volumes:
- /wherever/docker/mastodon/data:/mastodon/public/system
- /wherever/docker/mastodon/logs:/mastodon/log
labels:
- traefik.enable=true
- traefik.http.routers.mastodon-web-secure.entrypoints=https
- traefik.http.routers.mastodon-web-secure.rule=Host(`domain.tld`)
- traefik.http.routers.mastodon-web-secure.tls=true
- traefik.http.routers.mastodon-web-secure.middlewares=hsts-headers@file
- traefik.http.routers.mastodon-web-secure.tls.certresolver=http
- traefik.http.routers.mastodon-web-secure.service=mastodon-web
- traefik.http.services.mastodon-web.loadbalancer.server.port=3000
- traefik.http.routers.mastodon-streaming-secure.entrypoints=https
- traefik.http.routers.mastodon-streaming-secure.rule=Host(`domain.tld`) && PathPrefix(`/api/v1/streaming`)
- traefik.http.routers.mastodon-streaming-secure.tls=true
- traefik.http.routers.mastodon-streaming-secure.middlewares=hsts-headers@file
- traefik.http.routers.mastodon-streaming-secure.tls.certresolver=http
- traefik.http.routers.mastodon-streaming-secure.service=mastodon-streaming
- traefik.http.services.mastodon-streaming.loadbalancer.server.port=4000
- traefik.docker.network=http_network
networks:
- mastodon_network
- http_network
mastodon-redis:
image: redis:alpine
container_name: mastodon-redis
restart: unless-stopped
security_opt:
- no-new-privileges:true
volumes:
- /wherever/docker/mastodon/redis:/data
networks:
- mastodon_network
mastodon-db:
image: postgres:9.6-alpine
container_name: mastodon-db
restart: unless-stopped
security_opt:
- no-new-privileges:true
volumes:
- /wherever/docker/mastodon/db:/var/lib/postgresql/data
environment:
- POSTGRES_USER=mastodon
- POSTGRES_DB=mastodon
- POSTGRES_PASSWORD=supersecretpassword
networks:
- mastodon_networkThis image has been tested and works great with the gVisor runtime.