erpnext

ERPNext image with the closed Frappe application set and the SSO guard. The deployment stack stays in docker-templates. This repository is the image only.

The process runs as the vendor frappe user, UID 1000. The vendor group is 0. Compose runs the container as UID 1000 and GID 1000 and sets a read-only root filesystem.

Image

git.openso.de/openso/erpnext:main

docker-templates uses git.openso.de/openso/erpnext with no tag. Docker resolves that reference to :latest. :latest is the same build as :main.

Runtime

1. The image build installs the pinned Frappe apps and registers erpnext_sso_guard on the bench Python path.
2. It writes /usr/local/share/erpnext-apps.txt and /usr/local/share/erpnext-runtime-manifest, then drops to the frappe user.
3. The container starts the vendor Frappe entrypoint. Site files, logs, and the runtime-manifest volume are Compose mounts. They are not in the image.

The public frontend and the Frappe roles bind-mount their entrypoints from the stack. Those scripts are not part of this image.

Environment

This image has no required runtime variable. Deployment switches such as the site name, SSO, and ERPNEXT_ENABLE_* live in docker-templates. They enable apps that are already baked. They do not install packages and they do not select another image.

Compose

services:
  app:
    image: git.openso.de/openso/erpnext
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ['CMD-SHELL', 'curl --fail --silent --show-error --max-time 5 -H "Host: $${FRAPPE_SITE_NAME_HEADER}" http://127.0.0.1:8080/api/method/ping >/dev/null']

Every Frappe role in the stack uses this same image.

Contents

Pin	Value
Base image	frappe/erpnext:v16.53.0@sha256:b192e88b4fb7ec18bd63d1aa01c466010e6a155ec92387ba214afb3c29731a64
erpnext_germany	aa8e84969a4e393fd370a6685284fd8c209f6643
eu_einvoice	263430dd0deb72137513fcbca724eb634fd8e39e
erpnext_datev	f21cb45dcc2f054426397af8a9a6971a4f389882
payments	cca07d9f9392e2ea0e521c5975151db9e4b6c321
hrms	b12d935b99c1434618845fdd9f3a3d340b5a3aed
lms	4f73d8691c9646e0f200968c2e7af9a5d4baebaa
education	322c01dc0937d3f848b7226d4ea929afd1b84c68
lending	8f9b1635683981c0f0bd86b230f531312dfa0a74
healthcare	5530f48c39a777c8156c293961618338666d5330
webshop	5ba16567c03405aa9f28fa7c58410eb02074c6c3
whatsapp	59bf3688f424994b1cbc23cd1cde5d543b60f620
telephony	9447577500a25d242088398157b72c654fa34b20
helpdesk	99c961681a69be4b33a2f6564e60f49780a2f685
builder	2f624c30a034bf2b3add155b9b50b4f8c2a70cf9
wiki	6e0e09ed6b235d2860eb8b5dabb4d32fc06c9c02
studio	5b9d70a5582ed55058f8d4962a7c9b7d3c3d8489
gameplan	9459e35547f8b5289d9715fe76f0e398dc19b5ce

NLTK data for Helpdesk search is downloaded during the build because the read-only root cannot fetch it later. A version bump changes one of the pins above.

Build

A push to main publishes git.openso.de/openso/erpnext:main and :latest. A tag v* publishes that tag and :latest. The first commit on main is that push.