Docker

docker run -d --name nooks \
  -p 8081:8081 \
  -v nooks-data:/var/lib/nooks \
  ghcr.io/hoshomoh/nooks

Open localhost:8081. The first person to arrive creates their account and names the instance.

Images are tagged 1.2.3, 1.2 and latest. Pin the major and minor if you want patches without surprises; pin the full version if you want exactly what you tested — the changelog says what is in each.

What is in the image

A static binary and a CA bundle. No shell, no package manager, nothing else — so there is nothing in it to keep patched, and nothing to exec into either.

It runs as an unprivileged user. Nooks never needs root, and an app that reads a shopping list has no business asking for it.

The volume

Everything the instance has lives in /var/lib/nooks: one SQLite file, and nothing else. Copy that directory and you have copied the instance — see Back up.

A named volume as above, or a bind mount if you would rather see the file:

-v ~/nooks:/var/lib/nooks

With a bind mount, the directory has to be writable by the image's unprivileged user:

mkdir -p ~/nooks && sudo chown 65532:65532 ~/nooks

Configuration

Every flag has an environment variable, which is what a container wants:

docker run -d --name nooks \
  -p 8081:8081 \
  -v nooks-data:/var/lib/nooks \
  -e NOOKS_SECURE_COOKIES=true \
  -e NOOKS_LOG_LEVEL=debug \
  ghcr.io/hoshomoh/nooks

NOOKS_DATA is already set to the volume, so leave it alone unless you are mounting somewhere else.

Is it well?

The binary can ask itself, which is how a health check works in an image with no shell in it to run curl:

docker exec nooks /usr/local/bin/nooks --health

Exit 0 means the instance answered.

Behind a domain

TLS and the headers live updates need are on the reverse proxy page. Turn on NOOKS_SECURE_COOKIES once TLS is terminating in front of it.