Run Brunel yourself

Brunel ships as a container image built from the repository's Dockerfile: the Next.js standalone server and nothing else, running as the unprivileged node user (uid 1000) with read-only application files.

Get the image

Each release publishes the image to GitHub Packages, only after lint, typecheck and the test suite pass:

docker pull ghcr.io/kymrapro-del/stratum:0.1.0

Verify it before you run it

Deploy by digest (@sha256:…), not by tag, so the image you verified is the image that runs.

Try it in demo mode

No database and no AI provider: the in-memory store and the deterministic architect answer, and a banner says so.

docker run --rm -p 3000:3000 -e BRUNEL_DEMO_MODE=1 ghcr.io/kymrapro-del/stratum:0.1.0

Run it for real

docker run -d --name brunel -p 3000:3000 --read-only --tmpfs /tmp \
  --tmpfs /app/.next/cache:uid=1000,gid=1000 \
  --cap-drop ALL --security-opt no-new-privileges \
  --env-file brunel.env \
  ghcr.io/kymrapro-del/stratum@sha256:<digest>

brunel.env holds the configuration; see Configuration reference. Keep it out of version control and readable only by the account that starts the container.

Notes

• Database migrations run on first use.
• TLS belongs in front of the container. Set AUTH_URL to the public https:// address: session cookies then use the __Host- prefix and the Secure flag.
• Client addresses: rate limits and IP allowlists read X-Real-IP, then the first X-Forwarded-For entry. Your reverse proxy must set these itself and overwrite any value from the client, and must overwrite X-Forwarded-Host. Never expose the container directly.
• Health: GET /api/health answers {"ok":true,…}; the image declares a Docker HEALTHCHECK on it.

Hardening checklist