Docker

The Docker setup gives you a persistent, restart-safe service scoped to the directories you mount.

Bring it up

cp .env.example .env        # set AUTH_TOKEN
docker compose up -d --build

Mount the host dirs you want scanned as read-only subpaths under /skills in docker-compose.yml. The first build downloads the embedding model into the image (~90 MB); subsequent runs are fully offline.

Compose details:

• a named volume holds the live index (DB_PATH=/data/registry.db),
• restart: unless-stopped,
• port 8765 published on loopback,
• HOST=0.0.0.0 inside the container + AUTH_TOKEN from the gitignored .env (binding off loopback requires a token).

Debian base, not Alpine

The image must stay on node:22-bookworm-slim (Debian/glibc) — sqlite-vec, better-sqlite3, and onnxruntime have no musl prebuilds. An Alpine base fails at runtime with no such module: vec0.

Serving a pre-built index

For a container that serves an index built elsewhere (no scan roots mounted), set SCAN_ON_BOOT=false — the server serves the persisted index instantly — and refresh by copying a new database in:

node scripts/scan-once.mjs qm.db auto      # build/refresh the index natively
docker cp qm.db quartermaster:/data/registry.db
docker restart quartermaster

In-container reindex is a no-op in that layout, because no scan roots are mounted.

Feeding it from other machines

A hub container can also receive pushes from the thin collector running on any other machine — no model or database needed on the source side.