The normal installer combines one Traefik stack, one Console stack, and one Compose project per Motherbase project. deploy/README.md recommends using ./setup.sh rather than assembling these files manually.

Compose file selection

setup.sh does not start the root docker-compose.yml; its local and VPS startup functions use the Console-managed rows above. deploy/docker-compose.verify.yml is not an installation topology either: every service extends the production file and replaces only the host ports, host mounts, external network and credentials, so a release can be smoke tested against the real service definitions.

Project stacks

deploy/docker-compose.dev-multi.yml

One local project per Compose project name:

Routes use the plain web entrypoint. A priority-200 router applies an IP allowlist of 127.0.0.1/32 to /api/admin and /console.

deploy/docker-compose.prod.yml

One production project per /srv/projects/<name>/.env.prod:

The edge network is the first of the two barriers that keep operator code away from the stack's internals: the sidecar is on it and so is api, while db and minio are not, so a function has no route to Postgres or object storage even before its fetch guard refuses a private address. See edge runtime.

Resource defaults are 0.5 CPU and 512M for db and api, 0.25 CPU and 256M for minio, and 0.5 CPU and 768M for edge-runtime. All externally routed services expose only container ports through Traefik.

One port is published, by an overlay rather than by this file: deploy/docker-compose.db-port.yml is merged into every project stack unconditionally (composeContextArgs in console/lib/compose.ts) and maps ${DB_BIND:-127.0.0.1}:${DB_PORT:-}:5432. The Console allocates DB_PORT from 54320-54419 at project creation and keeps it for the life of the project, so a saved connection string survives a recreate; DB_BIND defaults to loopback, so the database is reachable only over an SSH tunnel. A project created before the overlay existed has no DB_PORT and Docker picks a free one — deliberately harmless; docker compose -p <project> port db 5432 reveals it.

The production deny router has priority 200 and restricts /api/admin, /console, and /admin to 127.0.0.1/32. The /ws router has priority 150; the general API router has priority 100.

Root docker-compose.yml

The root stack contains db, minio, one-shot createbuckets, edge-runtime, and api. Everything but the sidecar sits on Compose's default network; edge-runtime is on a private edge network and api joins both. Every published port is bound to loopback: Postgres as 127.0.0.1:${POSTGRES_PORT:-55432}:5432, MinIO as 127.0.0.1:${MINIO_PORT:-59000}:9000, MinIO Console as 127.0.0.1:${MINIO_CONSOLE_PORT:-59001}:9001, and the API as 127.0.0.1:5001:5001. Its named volumes are db_data and minio_data.

Database and MinIO health checks run every five seconds with ten retries. The API waits for a healthy database and MinIO, successful bucket creation, and a started edge-runtime, but has no Compose health check of its own. EDGE_RUNTIME_TOKEN defaults to dev-edge-runtime-token here — a development convenience the production file deliberately refuses (it fails the stack when the variable is unset).

Console stacks

deploy/console/docker-compose.dev.yml

The orchestrator uses deploy/docker-compose.dev-multi.yml. It has a read-only root, /tmp and /run tmpfs mounts, no Linux capabilities, and no-new-privileges.

deploy/console/docker-compose.yml

The production file has the same two services. The orchestrator mounts the host Docker socket read-only and /srv/projects read-only; the Console mounts /srv/projects writable but has neither the socket nor Docker CLI. They communicate on an internal orchestration network with ORCHESTRATION_SECRET.

Both services have read-only roots, dropped capabilities, and no-new-privileges. Orchestrator health checks 5501/health; Console health checks 5500/. The Console has no published host port: Traefik routes CONSOLE_DOMAIN to container port 5500 over traefik_proxy.

Traefik stacks

deploy/traefik/docker-compose.dev.yml runs the same two services as the production stack, with dev-friendly defaults: a docker-proxy (${TRAEFIK_DOCKER_PROXY_IMAGE:-nginx:alpine}) that holds the Docker socket and rewrites old Docker API versions, and ${TRAEFIK_IMAGE:-traefik:v3.3}, which publishes 80 and the insecure dashboard on 8080 and joins both traefik_proxy and traefik_internal. HTTP only: no TLS, no ACME, no volumes and no health check.

The proxy is not cosmetic. Docker 29 dropped API versions below 1.40 while Traefik's embedded client still asks for 1.24; without the rewrite Traefik loads zero routers and every <name>.localhost answers 404, which a browser then reports as a CORS failure.

deploy/traefik/docker-compose.yml runs two services:

• docker-proxy uses the required TRAEFIK_DOCKER_PROXY_IMAGE, mounts the Docker socket and docker-proxy.conf, and listens only on internal port 2375 over traefik_internal.
• traefik uses the required TRAEFIK_IMAGE, publishes 80 and 443, stores ACME state in the bind mount deploy/traefik/acme:/acme, and joins both traefik_proxy and traefik_internal.

Neither service declares a Compose health check. See Traefik and TLS for routers and certificate resolvers.

Dockerfiles

The API image command waits for its database, runs apps/server/scripts/run-migrations.js, then starts apps/server/dist/app.js. .dockerignore excludes every node_modules, dist, .env, log, upload, .git, and .turbo path from build context so host artifacts and secrets are not copied into images.