Oracle Container Images - ericfitz/tmi GitHub Wiki

Oracle Container Images

This page covers the Oracle Autonomous Database (ADB) variant of the TMI server container image (Dockerfile.server-oracle). Oracle ADB is a fully supported database backend; OCI itself is no longer a supported deployment target (see Terraform-Deployment for AWS and Local-Development-Cluster for local clusters).

Overview

Property Value
Dockerfile Dockerfile.server-oracle
Base Oracle Linux 9 (builder), Oracle Linux 9-slim (runtime)
Database driver godror via Oracle Instant Client 23ai (CGO, built with -tags oracle)
Runtime user non-root tmi
Port 8080
Wallet mount /wallet (read-only mount; wallet.zip is extracted at startup)

The image is selected automatically by the build script when --db-backend oracle-adb is used. The Redis image is not Oracle-specific; it is built from Dockerfile.redis.

Building

Container builds are managed by scripts/build-app-containers.py:

# Server image with Oracle ADB support, built locally
uv run scripts/build-app-containers.py --target local --db-backend oracle-adb --component server

# Same, with Grype vulnerability scan and Syft SBOM
uv run scripts/build-app-containers.py --target local --db-backend oracle-adb --component server --scan

Options: --target is local or aws; --component is server, redis, extractor, chunkembed, controller, or all; --arch is arm64, amd64, or both; --db-backend is postgresql (default) or oracle-adb; plus --registry, --push, --scan, --scan-only, and --no-cache. Multi-arch (--arch both) builds require --push.

Related Make targets: build-app, build-app-scan, build-app-aws, build-server-container, build-redis-container, build-all, and scan-containers. These use the default PostgreSQL backend; use the script directly for the Oracle variant.

Environment Variables

Variable Required Description
TMI_DATABASE_URL Yes e.g. oracle://user:password@tns_alias
TMI_ORACLE_WALLET_LOCATION No Set automatically by the entrypoint to /tmp/wallet after extraction
TMI_REDIS_URL Yes e.g. redis://:password@localhost:6379/0 (or TMI_REDIS_HOST/TMI_REDIS_PORT/TMI_REDIS_PASSWORD/TMI_REDIS_DB)

See Configuration-Reference for the full list.

Running Locally

docker run -p 8080:8080 \
  -v /path/to/wallet:/wallet:ro \
  -e TMI_DATABASE_URL=oracle://your_user:your_password@your_tns_alias \
  -e TMI_REDIS_URL=redis://host.docker.internal:6379 \
  <your-oracle-server-image>

The entrypoint extracts wallet.zip from the /wallet mount to /tmp/wallet, rewrites the DIRECTORY path in sqlnet.ora, and sets TNS_ADMIN and TMI_ORACLE_WALLET_LOCATION. For a local dev server against Oracle ADB, make dev-up DB=oracle is also available (see Local-Development-Cluster).

Oracle Wallet Configuration

  1. Download the wallet ZIP for your Autonomous Database from the Oracle Cloud Console (DB Connection > Download Wallet).
  2. Put wallet.zip in a directory and mount it read-only at /wallet.

You can instead pre-extract the wallet; it should contain tnsnames.ora, sqlnet.ora, and cwallet.sso.

Security

  • Non-root runtime user; security patches applied during build; minimal runtime dependencies.
  • Keep wallet files and database credentials out of images and version control; mount the wallet read-only.
  • Scan images with --scan (Grype + Syft SBOM) or make scan-containers; reports (SARIF, text, CycloneDX) are written to security-reports/.

Troubleshooting

Oracle Connection Issues

  1. Verify the wallet is mounted at /wallet and contains wallet.zip (the entrypoint logs the extraction).
  2. Check the TNS alias in TMI_DATABASE_URL matches tnsnames.ora.
  3. Ensure TNS_ADMIN points at the extracted wallet directory.
  4. Verify the database user has the required permissions.

Build Failures

The Dockerfile auto-detects architecture (amd64/arm64). Cross-platform builds need Docker buildx.

Related Documentation