Run any Skill in Manus with one click

Get Started

vm-docker

Stars76

Forks4

UpdatedApril 6, 2026 at 10:14

Deploy Docker services on VM with Traefik and Homepage. Use for VM container deploys.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

htlin222

htlin222/dotfiles

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Network and Computer Systems AdministratorsComputer and Mathematical Occupations·SOC 15-1244

File Explorer

8 files

SKILL.md

readonly

name	vm-docker
description	Deploy Docker services on VM with Traefik and Homepage. Use for VM container deploys.

Docker on VM with Traefik + Homepage

Overview

Deploy Docker services on the VM (Pop!_OS). Web services go behind Traefik (port 80) and register on Homepage (dashboard at /).

Access domain: vm.local (mDNS) — use for app CMD_DOMAIN/BASE_URL, NOT vm
Network: traefik-proxy (external bridge) — all web containers must join
Crane: ~/go/bin/crane (NOT on PATH)
Compose: docker compose (plugin at ~/.docker/cli-plugins/). Must cd into service dir — -f flag broken

Architecture

Port 80 → Traefik ──┬── /              → Homepage (dashboard)
                     ├── /hedgedoc      → HedgeDoc (:3000) [subpath-aware]
                     ├── /freshrss      → FreshRSS (:80)
                     ├── /traefik       → Traefik dashboard (api@internal)
                     └── /<service>     → Your new service

Direct ports ───────── :6060            → BookLore [no subpath support]

Config:  ~/traefik/traefik.yml          — static config
         ~/traefik/dynamic/<service>.yml — per-service routing
         ~/homepage/config/services.yaml — dashboard entries

Deploy Checklist

Prepare — mkdir -p ~/docker/<service>/{data,config}
Pull — ~/go/bin/crane pull <image>:<tag> /tmp/<name>.tar
Load — docker load -i /tmp/<name>.tar
Compose — Write ~/docker/<service>/docker-compose.yml → cd ~/docker/<service> && docker compose up -d
Traefik — Create ~/traefik/dynamic/<service>.yml (auto-reloads)
Validate before writing configs — curl-test EVERY URL/route before hardcoding into config files (see Validation section)
Homepage — Add entry to ~/homepage/config/services.yaml + group in settings.yaml
Verify — curl -sI --noproxy '*' http://localhost/<service>

Validation (MUST DO before writing configs)

Always curl-test links before hardcoding them. Do not assume a route works — prove it.

# 1. Test container responds directly (find internal IP or use exposed port)
curl -sI --noproxy '*' http://127.0.0.1:<host-port>/

# 2. Test Traefik route works (after writing dynamic config, before Homepage)
curl -sI --noproxy '*' http://127.0.0.1/<service>/

# 3. Test subpath: check HTML AND assets (not just the first response)
curl -s --noproxy '*' http://127.0.0.1/<service>/ | grep -E '<base href|<script src|<link.*href'
# If asset paths are absolute (e.g. /styles.css not ./<service>/styles.css) → subpath won't work

# 4. Test Homepage href URL resolves (the exact URL that will go in services.yaml)
curl -sI --noproxy '*' <href-value>

# 5. Test widget URLs (e.g. Traefik widget)
curl -s --noproxy '*' http://traefik:8080/api/overview

Rule: If curl returns 404, 502, or broken assets → fix FIRST, then write the config.

Key Gotchas

Gotcha	Detail
Container name	Use `http://<container>:<port>` in Traefik config, NOT localhost
Sub-path + stripPrefix	Need BOTH: `stripPrefix` in Traefik AND app's `BASE_URL`/`CMD_URL_PATH`. Test CSS/JS assets, not just HTML. BUT some SPAs (e.g. Booklore) don't support subpath at all — use direct port instead
Subpath compatibility	Before deploying behind subpath, check if the app supports it. SPAs with hardcoded `<base href="/">` and no `BASE_PATH` config will break. Use direct host port + Homepage `href: http://172.16.252.7:<port>` as fallback
CMD_DOMAIN must match access IP	For apps like HedgeDoc with `CMD_DOMAIN`, set it to the IP/hostname users actually use (e.g. `172.16.252.7`), NOT `vm.local` if users access via IP
No host ports	Don't expose ports if Traefik handles routing. Exception: apps without subpath support MUST expose host ports
Traefik dashboard needs 2 routers	Dashboard at `/traefik` uses `stripPrefix` + `api@internal`. But dashboard JS calls `/api/...` hardcoded — need a second router `PathPrefix(/api)` → `api@internal` (no strip). Without it, API calls fall through to Homepage and dashboard shows empty data. Do NOT use `api.basePath` — it breaks the insecure port API and the Homepage widget
Priority 10	Set on all routers so Homepage `/` catch-all still works
Auth	`auth@file` for BasicAuth — omit for public services
Volume paths	Always absolute: `/home/htlin222/docker/<service>/...`

Deep-Dive Docs

Topic	File
Templates (compose, traefik, homepage, makefile)	@templates.md
Troubleshooting	@troubleshooting.md
Reference stacks (ready-to-deploy)	`references/*.yml`

Homepage Groups

Group	Current Services
Media	Booklore (direct port :6060, no subpath support)
Productivity	HedgeDoc (subpath via Traefik, `CMD_DOMAIN=172.16.252.7`)
Infrastructure	Traefik

More from this repository

same repository

kimi-webbridge

htlin222/dotfiles

Kimi WebBridge lets AI control the user's real browser — navigate, click, type, read, screenshot, and interact with any website using the user's actual login sessions. Use this skill whenever the user wants to interact with websites, automate browser tasks, scrape web content, or perform any action requiring a real browser. Also use when the user mentions "browser", "webpage", "open URL", "screenshot", or asks to read/interact with any website. Use even for simple-sounding browser requests — the daemon handles all complexity.

2026-06-1976

agent-demo-recorder

htlin222/dotfiles

Record demo GIFs/MP4s of agent TUI sessions (Claude Code, Codex CLI, other agent CLIs), synchronized via a Stop-hook sentinel so the recording knows exactly when each response finishes. Two modes - scripted (VHS tape, repeatable) and live/adaptive (tmux + asciinema, where the outer Claude reads each inner response and decides the next prompt). Use when the user wants to record, capture, or make a demo/GIF/video of a Claude Code or Codex session, create a .tape file, drive a nested agent session interactively, or asks about VHS/asciinema recording of an agent CLI.

2026-06-1376

cf-gate

htlin222/dotfiles

Put a website behind a Cloudflare Access (Zero Trust) login gate, or remove one, entirely from the CLI — no dashboard GUI. Use when the user wants to password/email-protect a hostname, gate a Cloudflare Pages or Workers site, restrict a site to specific emails, set up Zero Trust Access, or asks about "cf-gate". Manages Access applications and allow-email policies via the Cloudflare API using a token in the skill's .env. Note: wrangler does NOT manage Access — this uses the Cloudflare REST API directly.

2026-06-1176

defer

htlin222/dotfiles

Defer execution of a slash-command or prompt until a timer elapses. Starts a background polling timer that prints "TIMER DONE" on stdout, then executes the deferred prompt.

2026-06-1176

codex-imagegen

htlin222/dotfiles

Generate an image via Codex CLI (OpenAI gpt-image-1) and save to a local path. Use when user asks to create/draw/generate an image AND save it (e.g. "draw X, save to images/y.png", "用 codex 生圖"). Requires `codex login` + `$OPENAI_API_KEY`.

2026-05-1376

deepseek-webgui

htlin222/dotfiles

DeepSeek client via the private chat.deepseek.com API (browser-exported userToken), not the official platform.deepseek.com API. Use for personal webgui automation, `x-ds-pow-response` / DeepSeekHashV1 POW solving, or SSE THINK/TOOL_SEARCH stream parsing.

2026-05-1376

Docker on VM with Traefik + Homepage

Overview

Deploy Docker services on the VM (Pop!_OS). Web services go behind Traefik (port 80) and register on Homepage (dashboard at /).

Access domain: vm.local (mDNS) — use for app CMD_DOMAIN/BASE_URL, NOT vm

Network: traefik-proxy (external bridge) — all web containers must join

Crane: ~/go/bin/crane (NOT on PATH)

Compose: docker compose (plugin at ~/.docker/cli-plugins/). Must cd into service dir — -f flag broken

Architecture

Port 80 → Traefik ──┬── / → Homepage (dashboard) ├── /hedgedoc → HedgeDoc (:3000) [subpath-aware] ├── /freshrss → FreshRSS (:80) ├── /traefik → Traefik dashboard (api@internal) └── /<service> → Your new service Direct ports ───────── :6060 → BookLore [no subpath support] Config: ~/traefik/traefik.yml — static config ~/traefik/dynamic/<service>.yml — per-service routing ~/homepage/config/services.yaml — dashboard entries

Deploy Checklist

Prepare — mkdir -p ~/docker/<service>/{data,config}

Pull — ~/go/bin/crane pull <image>:<tag> /tmp/<name>.tar

Load — docker load -i /tmp/<name>.tar

Compose — Write ~/docker/<service>/docker-compose.yml → cd ~/docker/<service> && docker compose up -d

Traefik — Create ~/traefik/dynamic/<service>.yml (auto-reloads)

Validate before writing configs — curl-test EVERY URL/route before hardcoding into config files (see Validation section)

Homepage — Add entry to ~/homepage/config/services.yaml + group in settings.yaml

Verify — curl -sI --noproxy '*' http://localhost/<service>

Validation (MUST DO before writing configs)

Always curl-test links before hardcoding them. Do not assume a route works — prove it.

# 1. Test container responds directly (find internal IP or use exposed port) curl -sI --noproxy '*' http://127.0.0.1:<host-port>/ # 2. Test Traefik route works (after writing dynamic config, before Homepage) curl -sI --noproxy '*' http://127.0.0.1/<service>/ # 3. Test subpath: check HTML AND assets (not just the first response) curl -s --noproxy '*' http://127.0.0.1/<service>/ | grep -E '<base href|<script src|<link.*href' # If asset paths are absolute (e.g. /styles.css not ./<service>/styles.css) → subpath won't work # 4. Test Homepage href URL resolves (the exact URL that will go in services.yaml) curl -sI --noproxy '*' <href-value> # 5. Test widget URLs (e.g. Traefik widget) curl -s --noproxy '*' http://traefik:8080/api/overview

Rule: If curl returns 404, 502, or broken assets → fix FIRST, then write the config.

Key Gotchas

Gotcha

Detail

Container name

Use http://<container>:<port> in Traefik config, NOT localhost

Sub-path + stripPrefix

Need BOTH: stripPrefix in Traefik AND app's BASE_URL/CMD_URL_PATH. Test CSS/JS assets, not just HTML. BUT some SPAs (e.g. Booklore) don't support subpath at all — use direct port instead

Subpath compatibility

Before deploying behind subpath, check if the app supports it. SPAs with hardcoded <base href="/"> and no BASE_PATH config will break. Use direct host port + Homepage href: http://172.16.252.7:<port> as fallback

CMD_DOMAIN must match access IP

For apps like HedgeDoc with CMD_DOMAIN, set it to the IP/hostname users actually use (e.g. 172.16.252.7), NOT vm.local if users access via IP

No host ports

Don't expose ports if Traefik handles routing. Exception: apps without subpath support MUST expose host ports

Traefik dashboard needs 2 routers

Dashboard at /traefik uses stripPrefix + api@internal. But dashboard JS calls /api/... hardcoded — need a second router PathPrefix(/api) → api@internal (no strip). Without it, API calls fall through to Homepage and dashboard shows empty data. Do NOT use api.basePath — it breaks the insecure port API and the Homepage widget

Priority 10

Set on all routers so Homepage / catch-all still works

Auth

auth@file for BasicAuth — omit for public services

Volume paths

Always absolute: /home/htlin222/docker/<service>/...

Deep-Dive Docs

Topic

File

Templates (compose, traefik, homepage, makefile)

@templates.md

Troubleshooting

@troubleshooting.md

Reference stacks (ready-to-deploy)

references/*.yml

Homepage Groups

Group

Current Services

Media

Booklore (direct port :6060, no subpath support)

Productivity

HedgeDoc (subpath via Traefik, CMD_DOMAIN=172.16.252.7)

Infrastructure

Traefik