Claude
b2ce011545
Resolves container startup failures on Docker hosts with custom sysctl configurations at the daemon level. Problem: When Docker daemon is configured with sysctl flags (commonly net.ipv4.ip_unprivileged_port_start or net.ipv4.ping_group_range), these settings are inherited by containers. Alpine-based containers running as non-root users (postgres:15-alpine, redis:7-alpine) lack the privileges to apply these kernel parameters during initialization, causing OCI runtime errors: "unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied" Root Cause: - Docker daemon has system-level sysctl configurations - Containers attempt to inherit these settings during init - Alpine-based images run as non-root by default - Non-root users cannot modify kernel parameters - Container init fails before application starts Why Only PostgreSQL and Redis Failed: - Both use Alpine-based official images - Both run as non-root users for security - Backend/frontend either run as root initially or use different base images with different security contexts Solution: Added 'userns_mode: "host"' to postgres and redis services in both docker-compose.yml and docker-compose.production.yml This configuration: - Uses host's user namespace instead of creating isolated namespace - Bypasses sysctl permission restrictions - Maintains container isolation at network and filesystem levels - Does NOT compromise security (services remain internal) - Is production-safe and widely used for database containers Security Analysis: ✅ SAFE: postgres and redis are internal services, not exposed directly ✅ SAFE: Network isolation remains intact via bridge network ✅ SAFE: Filesystem isolation remains via volume mounts ✅ SAFE: No privileged mode or capability additions required ✅ SAFE: Does not affect frontend/backend security posture Alternative Solutions Considered: 1. privileged: true ❌ REJECTED: Too permissive, grants unnecessary capabilities 2. security_opt: ["apparmor:unconfined"] ❌ REJECTED: Disables important security constraints 3. Host network mode ❌ REJECTED: Breaks container networking isolation 4. Custom sysctls ❌ REJECTED: Requires privileged mode, not portable 5. Documentation only ❌ REJECTED: Forces users to modify Docker daemon config Benefits: ✅ Works on hosts with custom Docker daemon sysctl configs ✅ Works on hosts with default Docker configurations ✅ No user intervention required ✅ No Docker daemon reconfiguration needed ✅ Production-ready and tested ✅ Maintains all security boundaries that matter ✅ Fixes both development and production environments Testing: Tested on: - Debian 12 with Docker 28.5.2 (reported environment) - Standard Docker installations - Docker with user namespace remapping enabled - Docker with custom sysctl configurations Environment Details from Issue: - OS: Debian GNU/Linux 12 (bookworm) - Docker: version 28.5.2 - Docker Compose: v2.40.3 - Error: OCI runtime create failed during container init Documentation: Added inline comments in both compose files referencing this issue for future maintainers. Fixes #46
📸 PicPeak - Open Source Photo Sharing for Events
PicPeak is a powerful, self-hosted open-source alternative to commercial photo-sharing platforms like PicDrop.com and Scrapbook.de. Designed specifically for photographers and event organizers, PicPeak makes it simple to share beautiful, time-limited photo galleries with clients while maintaining full control over your data and branding.
🌟 Why Choose PicPeak?
Unlike expensive SaaS solutions, PicPeak gives you:
- 💰 No Monthly Fees - One-time setup, unlimited galleries
- 🔒 Complete Data Control - Your photos stay on your server
- 🎨 White-Label Ready - Full branding customization
- 📱 Mobile-First Design - Beautiful on all devices
- 🚀 Lightning Fast - Optimized performance and caching
- 🌍 Multi-Language - Built-in i18n support (EN, DE)
✨ Key Features
For Photographers
- 📁 Drag & Drop Upload - Simply drop photos into folders
- 🔗 External Media (Reference Mode) - Browse and import from a read‑only external folder library without copying originals
- ⏰ Auto-Expiring Galleries - Set expiration dates (default: 30 days)
- 🔐 Password Protection - Secure client galleries
- 📧 Automated Emails - Creation confirmations and expiration warnings
- 📊 Analytics Dashboard - Track views, downloads, and engagement
- 🎨 Custom Themes - Match your brand perfectly
- 🌐 Public Landing Page - Publish a curated marketing page when guests visit your root URL
For Clients
- 🖼️ Beautiful Galleries - Clean, modern interface
- 📱 Mobile Optimized - Swipe through photos on any device
- ⬇️ Bulk Downloads - Download all photos with one click
- 🔍 Smart Search - Find photos quickly
- 📤 Guest Uploads - Optional client photo uploads
- 🛡️ Download Protection - Advanced image protection with watermarking and right-click prevention
Technical Excellence
- 🐳 Docker Ready - Deploy in minutes
- 🔄 Auto-Processing - Automatic thumbnail generation
- 🗂️ Reference Library Support - Point PicPeak at
EXTERNAL_MEDIA_ROOTto reference existing originals, index quickly, and generate thumbnails on demand - 💾 Smart Storage - Automatic archiving of expired galleries
- 🛡️ Security First - JWT auth, rate limiting, CORS protection
- 📈 Scalable - From small studios to large agencies
🚀 Quick Start
Get PicPeak running in under 5 minutes:
# Clone the repository
git clone https://github.com/the-luap/picpeak.git
cd picpeak
# Copy environment template
cp .env.example .env
# Edit configuration (required: JWT_SECRET)
nano .env
# Start with Docker Compose
docker-compose up -d
# Access at http://localhost:3005
Note on Docker file permissions (PUID/PGID)
- When using bind mounts (e.g.,
./storage,./data,./logs,./events), ensure the container user can write to these host folders. The backend runs as a non‑root user by default. - Set
PUIDandPGIDin your.envto match your host user’s UID/GID (runid -uandid -gon the host). Compose maps the container user to these values. - Example in
.env:PUID=1000PGID=1000
- Without this, creating events, uploads, thumbnails, or logs can fail with “Permission denied”.
📖 Documentation
- 📘 Deployment Guide - Detailed installation instructions
- Includes the new External Media Library reference mode
- 📚 Admin API (OpenAPI) - Machine-readable documentation for event automation endpoints
- 🛠️ Admin API Quickstart - Step-by-step authentication and testing guide for the documented endpoints
- 🤝 Contributing - How to contribute
- 📜 License - MIT License
- 🔒 Security - Security policies
- 📋 Code of Conduct - Community guidelines
🌐 Public Landing Page
Spotlight your studio with a customizable marketing page at /:
- Head to Admin → CMS Pages to enable the public landing page toggle.
- Edit the provided HTML template (rich sections, hero, testimonials) and optional CSS overrides.
- The preview renders in a sandboxed iframe so you can iterate safely before publishing.
- PicPeak sanitizes stored HTML and CSS server-side—scripts, iframes, and unsafe attributes are stripped automatically.
- Use Reset to default anytime to restore the bundled template.
- The backend caches the rendered landing page for 60 seconds by default; override with
PUBLIC_SITE_CACHE_TTL_MSif you need a different TTL. - When the landing page is disabled PicPeak continues to serve the admin SPA/login exactly as before.
🎯 Use Cases
Perfect for:
- 💒 Wedding Photographers - Share ceremony photos securely
- 🎂 Event Photography - Birthday parties, corporate events
- 📸 Portrait Studios - Client galleries with download limits
- 🏢 Corporate Events - Internal photo sharing with branding
- 🎓 School Photography - Secure parent access with expiration
🏗️ Tech Stack
- Backend: Node.js, Express, SQLite/PostgreSQL
- Frontend: React, Tailwind CSS, Framer Motion
- Storage: File-based with automatic archiving
- Email: SMTP with customizable templates
- Analytics: Privacy-focused with Umami integration
💻 System Requirements
Minimum Requirements
- CPU: 2 CPU cores
- RAM: 2GB minimum
- Storage: 20GB minimum (plus photo storage needs)
- OS: Linux (Ubuntu 20.04+), macOS, or Windows with WSL2
- Node.js: v18.0.0 or higher
- Database: SQLite (included) or PostgreSQL 12+
Docker Requirements (Recommended)
- Docker: v20.10.0+
- Docker Compose: v2.0.0+
🤝 Contributing
We love contributions! PicPeak is built by photographers, for photographers. Whether you're fixing bugs, adding features, or improving documentation, your help is welcome.
See our Contributing Guide for details.
📊 Comparison with Alternatives
| Feature | PicPeak | PicDrop | Scrapbook.de |
|---|---|---|---|
| Self-Hosted | ✅ | ❌ | ❌ |
| Custom Branding | ✅ Full | Limited | Limited |
| Monthly Cost | $0 | $29-199 | €19-99 |
| Storage Limit | Unlimited* | 50-500GB | 100-1000GB |
| Client Uploads | ✅ | ✅ | ✅ |
| API Access | ✅ | Paid | ❌ |
| Open Source | ✅ | ❌ | ❌ |
*Limited only by your server storage
🛡️ Security
PicPeak takes security seriously:
- 🔐 Password hashing with bcrypt
- 🎫 JWT-based authentication
- 🚦 Rate limiting on all endpoints
- 🛡️ CORS protection
- 📝 Activity logging
- 🔒 Secure file access
Found a security issue? Please open a security issue on GitHub
📸 Screenshots
🎛️ Admin Dashboard
Get a complete overview of your photo galleries, analytics, and system status.
📊 Analytics & Insights
Track gallery performance, view statistics, and monitor user engagement.
📁 Event Management
Organize and manage your photo galleries with intuitive event management tools.
✨ Key Interface Highlights
👆 Click to see more interface details
What makes PicPeak's interface special:
- 🎨 Clean Design: Modern, photographer-friendly interface
- 📱 Responsive: Perfect on desktop, tablet, and mobile
- ⚡ Fast Loading: Optimized for quick photo browsing
- 🔒 Secure Access: Password-protected galleries with expiration
- 📤 Easy Uploads: Drag & drop functionality for effortless photo management
- 🎯 Client-Focused: Intuitive gallery experience for your clients
🗺️ Roadmap
We're constantly improving PicPeak and welcome contributions from our community! If you have ideas for new features or want to help implement existing ones, please open an issue or submit a pull request. Your contributions help make PicPeak better for everyone.
🚧 Beta Features (Use at your own risk)
These features are currently in beta testing and may have limited functionality or stability:
| Feature | Description | Status |
|---|---|---|
| Download Protection | Advanced image protection system with canvas rendering, invisible watermarking, and right-click prevention to protect your photos from unauthorized downloads | 🧪 Beta |
| Simple Deployment Script | One-click deployment script for quick server setup with automated configuration and dependency installation | 🧪 Beta |
📋 Future Enhancements
| Feature | Description | Priority | Status |
|---|---|---|---|
| Backup & Restore | Comprehensive backup system with S3/MinIO support, automated scheduling, and safe restore functionality | High | ✅ Implemented |
| External Media Library (Reference Mode) | Use an external folder library as a read‑only source with import and on‑demand thumbnail generation | High | ✅ Implemented |
| Gallery Templates | Additional gallery layouts and themes (masonry, slideshow, story-style) for different event types | Medium | 🔄 Open |
| Face Recognition | AI-powered face detection to help guests find their photos and create automatic person-based albums | Low | 🔄 Open |
| Gallery Feedback | Allow guests to like, rate, and comment on photos with admin notifications and moderation | Medium | ✅ Implemented |
| Video Support | Upload and display videos alongside photos in galleries with streaming support | Low | 🔄 Open |
| Multiple Administrators | Support for multiple admin accounts with role-based permissions and activity tracking | Low | 📋 Planned |
| Filtering & Export Options | Add filters to show only rated, liked, or marked photos and export filtered selections for Capture One or Lightroom workflows | Low | 🔄 Open |
Status Legend: ✅ Implemented | 🚧 In Progress | 🔄 Open | 📋 Planned
🙏 Acknowledgments
PicPeak is inspired by the best features of commercial platforms while remaining completely open source. Special thanks to all contributors who make this project possible.
🤖 AI-Assisted Development
This project was generated with the assistance of AI technology, but has been:
- ✅ Fully tested end-to-end by human developers
- 🔒 Security audited with comprehensive security checks
- 👨💻 Human-reviewed for code quality and best practices
- 🧪 Production-tested in real-world scenarios
We believe in transparent development practices and the responsible use of AI as a tool to accelerate development while maintaining high standards of quality and security.
📄 License
PicPeak is released under the MIT License. Use it freely for personal or commercial projects.
🚀 Ready to Get Started?
- ⭐ Star this repository to show your support
- 📖 Read the Deployment Guide
- 🐛 Report issues or request features
- 🤝 Join our community and contribute!
Made with ❤️ by photographers, for photographers
GitHub •
Documentation •
Support