From 8bf6193fd0a9472020383373eca30fb9535929ad Mon Sep 17 00:00:00 2001 From: Zoey Date: Wed, 5 Aug 2026 20:09:57 +0200 Subject: [PATCH 1/3] fix dockerlint Signed-off-by: Zoey --- .github/workflows/docker-lint.yml | 11 +++++------ Containers/apache/Dockerfile | 5 +++-- Containers/borgbackup/Dockerfile | 2 +- Containers/clamav/Dockerfile | 6 +++--- Containers/collabora/Dockerfile | 6 +++--- Containers/docker-socket-proxy/Dockerfile | 4 ++-- Containers/domaincheck/Dockerfile | 4 ++-- Containers/eurooffice/Dockerfile | 2 +- Containers/fulltextsearch/Dockerfile | 5 ++--- Containers/harp/Dockerfile | 2 +- Containers/imaginary/Dockerfile | 4 ++-- Containers/mastercontainer/Dockerfile | 7 ++++--- Containers/nextcloud/Dockerfile | 6 ++++-- Containers/notify-push/Dockerfile | 10 +++++++--- Containers/onlyoffice/Dockerfile | 2 +- Containers/postgresql/Dockerfile | 5 +++-- Containers/redis/Dockerfile | 5 +++-- Containers/talk-recording/Dockerfile | 5 +++-- Containers/talk/Dockerfile | 5 +++-- Containers/watchtower/Dockerfile | 2 +- Containers/whiteboard/Dockerfile | 6 +++--- 21 files changed, 57 insertions(+), 47 deletions(-) diff --git a/.github/workflows/docker-lint.yml b/.github/workflows/docker-lint.yml index 42ae0917..c4a69df8 100644 --- a/.github/workflows/docker-lint.yml +++ b/.github/workflows/docker-lint.yml @@ -34,13 +34,12 @@ jobs: - name: run lint run: | - DOCKERFILES="$(find ./Containers -name Dockerfile)" - mapfile -t DOCKERFILES <<< "$DOCKERFILES" - for file in "${DOCKERFILES[@]}"; do + for file in $(find Containers -name "*Dockerfile"); do # DL3018 warning: Pin versions in apk add. Instead of `apk add ` use `apk add =` - # DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check - hadolint "$file" --ignore DL3018 --ignore DL4006 | tee -a ./hadolint.log + # DL3041 warning: Specify version with `dnf install -y -`. + # DL3066 info: Non-numeric user-id may not be resolvable by host system + hadolint "$file" --ignore DL3018 --ignore DL3041 --ignore DL3066 | tee -a hadolint.log done - if grep -q "DL[0-9]\+\|SC[0-9]\+" ./hadolint.log; then + if [ -s hadolint.log ]; then exit 1 fi diff --git a/Containers/apache/Dockerfile b/Containers/apache/Dockerfile index cc87763f..d1f2c4ce 100644 --- a/Containers/apache/Dockerfile +++ b/Containers/apache/Dockerfile @@ -14,6 +14,7 @@ COPY --chmod=775 healthcheck.sh /healthcheck.sh VOLUME /mnt/data +SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache shadow; \ @@ -95,14 +96,14 @@ RUN set -ex; \ echo "root:$(openssl rand -base64 12)" | chpasswd; \ apk --no-cache del openssl -USER 33 +USER www-data:www-data ENTRYPOINT ["/start.sh"] CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"] ENV AIO_LOG_LEVEL=warn -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/borgbackup/Dockerfile b/Containers/borgbackup/Dockerfile index c285e587..81e68f78 100644 --- a/Containers/borgbackup/Dockerfile +++ b/Containers/borgbackup/Dockerfile @@ -21,7 +21,7 @@ COPY borg_excludes / ENTRYPOINT ["/start.sh"] # hadolint ignore=DL3002 -USER root +USER root:root LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ diff --git a/Containers/clamav/Dockerfile b/Containers/clamav/Dockerfile index 9d5a6ebd..137a114a 100644 --- a/Containers/clamav/Dockerfile +++ b/Containers/clamav/Dockerfile @@ -6,7 +6,7 @@ RUN set -ex; \ apk add --no-cache tzdata clamav clamav-milter supervisor bash; \ mkdir -p /tmp /var/lib/clamav /run/clamav /var/log/supervisord /var/run/supervisord; \ chmod 777 -R /tmp /run/clamav /var/log/clamav /var/log/supervisord /var/run/supervisord; \ - chown -R 100:100 /var/lib/clamav; \ + chown -R clamav:clamav /var/lib/clamav; \ sed -i "s|#\?MaxDirectoryRecursion.*|MaxDirectoryRecursion 30|g" /etc/clamav/clamd.conf; \ sed -i "s|#\?MaxScanSize.*|MaxScanSize 2000M|g" /etc/clamav/clamd.conf; \ sed -i "s|#\?MaxFileSize.*|MaxFileSize 2000M|g" /etc/clamav/clamd.conf; \ @@ -35,7 +35,7 @@ COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh COPY --chmod=664 supervisord.conf /supervisord.conf -USER 100 +USER clamav:clamav RUN set -ex; \ freshclam --foreground --stdout VOLUME /var/lib/clamav @@ -50,4 +50,4 @@ LABEL com.centurylinklabs.watchtower.enable="false" \ org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \ org.opencontainers.image.vendor="Nextcloud" \ org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md" -HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh +HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"] diff --git a/Containers/collabora/Dockerfile b/Containers/collabora/Dockerfile index 6f94afd6..dd4f0548 100644 --- a/Containers/collabora/Dockerfile +++ b/Containers/collabora/Dockerfile @@ -2,15 +2,15 @@ # From a file located probably somewhere here: https://github.com/CollaboraOnline/online/blob/master/docker/from-packages/Dockerfile FROM collabora/code:26.04.2.4.1 -USER root +USER root:root ARG DEBIAN_FRONTEND=noninteractive COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh -USER 1001 +USER cool:cool -HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh +HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/docker-socket-proxy/Dockerfile b/Containers/docker-socket-proxy/Dockerfile index 11a6a78a..3c569421 100644 --- a/Containers/docker-socket-proxy/Dockerfile +++ b/Containers/docker-socket-proxy/Dockerfile @@ -2,7 +2,7 @@ FROM haproxy:3.4.3-alpine # hadolint ignore=DL3002 -USER root +USER root:root ENV NEXTCLOUD_HOST=nextcloud-aio-nextcloud RUN set -ex; \ apk upgrade --no-cache -a; \ @@ -17,7 +17,7 @@ COPY --chmod=775 *.sh / COPY --chmod=664 haproxy.cfg /haproxy.cfg ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/domaincheck/Dockerfile b/Containers/domaincheck/Dockerfile index a6937640..9efc6d4f 100644 --- a/Containers/domaincheck/Dockerfile +++ b/Containers/domaincheck/Dockerfile @@ -13,10 +13,10 @@ COPY --chown=www-data:www-data lighttpd.conf /lighttpd.conf COPY --chmod=775 start.sh /start.sh -USER www-data +USER www-data:www-data ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD nc -z 127.0.0.1 $APACHE_PORT || exit 1 +HEALTHCHECK CMD ["/bin/sh", "-c", "nc -z 127.0.0.1 $APACHE_PORT || exit 1"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/eurooffice/Dockerfile b/Containers/eurooffice/Dockerfile index c232c00e..f9334493 100644 --- a/Containers/eurooffice/Dockerfile +++ b/Containers/eurooffice/Dockerfile @@ -5,7 +5,7 @@ FROM ghcr.io/euro-office/documentserver:v9.3.2 COPY --chmod=775 healthcheck.sh /healthcheck.sh -HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh +HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/fulltextsearch/Dockerfile b/Containers/fulltextsearch/Dockerfile index 75a9906e..735d53d4 100644 --- a/Containers/fulltextsearch/Dockerfile +++ b/Containers/fulltextsearch/Dockerfile @@ -2,9 +2,8 @@ # Probably from here https://github.com/elastic/dockerfiles/blob/9.3/elasticsearch/Dockerfile FROM elasticsearch:9.4.4 -USER root +USER root:root -# hadolint ignore=DL3041 RUN set -ex; \ \ microdnf update -y; \ @@ -18,7 +17,7 @@ COPY --chmod=775 healthcheck.sh /healthcheck.sh USER 1000:0 -HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD /healthcheck.sh +HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/harp/Dockerfile b/Containers/harp/Dockerfile index 0a931846..143a4bd9 100644 --- a/Containers/harp/Dockerfile +++ b/Containers/harp/Dockerfile @@ -14,4 +14,4 @@ LABEL com.centurylinklabs.watchtower.enable="false" \ org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md" # Copied from upstream -HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD /healthcheck.sh +HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD ["/healthcheck.sh"] diff --git a/Containers/imaginary/Dockerfile b/Containers/imaginary/Dockerfile index e3672eb2..21b322ab 100644 --- a/Containers/imaginary/Dockerfile +++ b/Containers/imaginary/Dockerfile @@ -36,13 +36,13 @@ COPY --chmod=775 healthcheck.sh /healthcheck.sh ENV PORT=9000 \ AIO_LOG_LEVEL=warn -USER 65534 +USER nobody:nobody # https://github.com/h2non/imaginary#memory-issues ENV MALLOC_ARENA_MAX=2 ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/mastercontainer/Dockerfile b/Containers/mastercontainer/Dockerfile index f53086d5..6c8b9042 100644 --- a/Containers/mastercontainer/Dockerfile +++ b/Containers/mastercontainer/Dockerfile @@ -31,7 +31,8 @@ COPY --chmod=664 Containers/mastercontainer/supervisord.conf /supervisord.conf WORKDIR /var/www/docker-aio -# hadolint ignore=SC2086,DL3047,DL3003 +SHELL ["/bin/ash", "-o", "pipefail", "-c"] +# hadolint ignore=SC2086,DL3003 RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache shadow; \ @@ -111,8 +112,8 @@ LABEL org.opencontainers.image.title="Nextcloud All-in-One Mastercontainer" \ com.docker.compose.project="nextcloud-aio" # hadolint ignore=DL3002 -USER root +USER root:root ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] diff --git a/Containers/nextcloud/Dockerfile b/Containers/nextcloud/Dockerfile index 576bae86..fc7774a0 100644 --- a/Containers/nextcloud/Dockerfile +++ b/Containers/nextcloud/Dockerfile @@ -9,6 +9,7 @@ ENV REDIS_DB_INDEX=0 # AIO settings start # Do not remove or change this line! ENV NEXTCLOUD_VERSION=33.0.7 +# hadolint ignore=DL3064 ENV AIO_TOKEN=123456 ENV AIO_URL=localhost # AIO settings end # Do not remove or change this line! @@ -27,6 +28,7 @@ VOLUME /mnt/ncdata VOLUME /var/www/html # Custom: change id of www-data user as it needs to be the same like on old installations +SHELL ["/bin/ash", "-o", "pipefail", "-c"] # hadolint ignore=SC2086,DL3003 RUN set -ex; \ apk upgrade --no-cache -a; \ @@ -279,11 +281,11 @@ RUN set -ex; \ chmod -R 777 /nc-updater # hadolint ignore=DL3002 -USER root +USER root:root ENTRYPOINT ["/start.sh"] CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/notify-push/Dockerfile b/Containers/notify-push/Dockerfile index b4d75905..95b6b077 100644 --- a/Containers/notify-push/Dockerfile +++ b/Containers/notify-push/Dockerfile @@ -4,6 +4,7 @@ FROM alpine:3.24.1 COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh +SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache \ @@ -15,12 +16,15 @@ RUN set -ex; \ # Give root a random password echo "root:$(openssl rand -base64 12)" | chpasswd; \ apk del --no-cache \ - openssl; + openssl; \ + delgroup www-data; \ + addgroup -g 33 -S www-data; \ + adduser -u 33 -S -D -G www-data -H -s /sbin/nologin www-data; -USER 33 +USER www-data:www-data ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/onlyoffice/Dockerfile b/Containers/onlyoffice/Dockerfile index 3d56119b..f60eea36 100644 --- a/Containers/onlyoffice/Dockerfile +++ b/Containers/onlyoffice/Dockerfile @@ -6,7 +6,7 @@ FROM onlyoffice/documentserver:9.3.1.2 COPY --chmod=775 healthcheck.sh /healthcheck.sh -HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh +HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/postgresql/Dockerfile b/Containers/postgresql/Dockerfile index 2f459704..df7625ee 100644 --- a/Containers/postgresql/Dockerfile +++ b/Containers/postgresql/Dockerfile @@ -8,6 +8,7 @@ COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh COPY --chmod=775 init-user-db.sh /docker-entrypoint-initdb.d/init-user-db.sh +SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache \ @@ -43,10 +44,10 @@ RUN set -ex; \ VOLUME /mnt/data -USER 999 +USER postgres:postgres ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/redis/Dockerfile b/Containers/redis/Dockerfile index 3734ffbc..a8920b0e 100644 --- a/Containers/redis/Dockerfile +++ b/Containers/redis/Dockerfile @@ -4,6 +4,7 @@ FROM redis:8.8.1-alpine COPY --chmod=775 start.sh /start.sh +SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache openssl bash; \ @@ -17,10 +18,10 @@ RUN set -ex; \ COPY --chmod=775 healthcheck.sh /healthcheck.sh -USER 999 +USER redis:redis ENTRYPOINT ["/start.sh"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/talk-recording/Dockerfile b/Containers/talk-recording/Dockerfile index 2006c5e5..8a677ac0 100644 --- a/Containers/talk-recording/Dockerfile +++ b/Containers/talk-recording/Dockerfile @@ -12,6 +12,7 @@ ENV ALLOW_ALL=false \ HPB_PATH=/standalone-signaling/ \ AIO_LOG_LEVEL=warn +SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache \ @@ -60,11 +61,11 @@ RUN set -ex; \ VOLUME /tmp WORKDIR /tmp -USER 122 +USER recording:recording ENTRYPOINT ["/start.sh"] CMD ["python", "-m", "nextcloud.talk.recording", "--config", "/conf/recording.conf"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/talk/Dockerfile b/Containers/talk/Dockerfile index ef4e0691..df945be4 100644 --- a/Containers/talk/Dockerfile +++ b/Containers/talk/Dockerfile @@ -48,6 +48,7 @@ COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh COPY --chmod=664 supervisord.conf /supervisord.conf +SHELL ["/bin/ash", "-o", "pipefail", "-c"] RUN set -ex; \ apk upgrade --no-cache -a; \ apk add --no-cache \ @@ -105,11 +106,11 @@ RUN set -ex; \ ln -s /opt/eturnal/bin/stun /usr/local/bin/stun; \ ln -s /opt/eturnal/bin/eturnalctl /usr/local/bin/eturnalctl -USER 1000 +USER eturnal:eturnal ENTRYPOINT ["/start.sh"] CMD ["supervisord", "-c", "/supervisord.conf"] -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] LABEL com.centurylinklabs.watchtower.enable="false" \ wud.watch="false" \ dockhand.update="false" \ diff --git a/Containers/watchtower/Dockerfile b/Containers/watchtower/Dockerfile index 1c1ce7f2..343a98eb 100644 --- a/Containers/watchtower/Dockerfile +++ b/Containers/watchtower/Dockerfile @@ -20,7 +20,7 @@ COPY --from=go /go/bin/watchtower /watchtower COPY --chmod=775 start.sh /start.sh # hadolint ignore=DL3002 -USER root +USER root:root ENV AIO_LOG_LEVEL="warn" diff --git a/Containers/whiteboard/Dockerfile b/Containers/whiteboard/Dockerfile index f87e3536..fd703beb 100644 --- a/Containers/whiteboard/Dockerfile +++ b/Containers/whiteboard/Dockerfile @@ -2,7 +2,7 @@ # Probably from this file: https://github.com/nextcloud/whiteboard/blob/main/Dockerfile FROM ghcr.io/nextcloud-releases/whiteboard:v1.5.9 -USER root +USER root:root RUN set -ex; \ apk add --no-cache bash jq; \ chmod 777 -R /tmp; \ @@ -11,12 +11,12 @@ RUN set -ex; \ printf '%s\n' '#!/bin/sh' "exec /usr/lib/chromium/chrome_crashpad_handler.real --no-periodic-tasks --database=\"\${CRASHPAD_DATABASE:-/tmp/chrome-crashpad}\" \"\$@\"" >/usr/lib/chromium/chrome_crashpad_handler; \ chmod +x /usr/lib/chromium/chrome_crashpad_handler; \ fi -USER 65534 +USER nobody:nobody COPY --chmod=775 start.sh /start.sh COPY --chmod=775 healthcheck.sh /healthcheck.sh -HEALTHCHECK CMD /healthcheck.sh +HEALTHCHECK CMD ["/healthcheck.sh"] WORKDIR /tmp From 6156c887f3874c43a205abeea4ddb89f0f6dab44 Mon Sep 17 00:00:00 2001 From: Zoey Date: Sat, 22 Aug 2026 11:16:58 +0200 Subject: [PATCH 2/3] add comment to workflow Signed-off-by: Zoey --- .github/workflows/docker-lint.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/docker-lint.yml b/.github/workflows/docker-lint.yml index c4a69df8..1db918f6 100644 --- a/.github/workflows/docker-lint.yml +++ b/.github/workflows/docker-lint.yml @@ -40,6 +40,7 @@ jobs: # DL3066 info: Non-numeric user-id may not be resolvable by host system hadolint "$file" --ignore DL3018 --ignore DL3041 --ignore DL3066 | tee -a hadolint.log done + # hadolint only prints to console if it finds issues, so the workflow needs to fail if it printed something if [ -s hadolint.log ]; then exit 1 fi From 01890dc628a3d013297b439775cf64a642facb1c Mon Sep 17 00:00:00 2001 From: Zoey Date: Sat, 22 Aug 2026 11:19:19 +0200 Subject: [PATCH 3/3] add comment to hadolint ignore for AIO_TOKEN Signed-off-by: Zoey --- Containers/nextcloud/Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Containers/nextcloud/Dockerfile b/Containers/nextcloud/Dockerfile index fc7774a0..9c4edb5d 100644 --- a/Containers/nextcloud/Dockerfile +++ b/Containers/nextcloud/Dockerfile @@ -9,6 +9,9 @@ ENV REDIS_DB_INDEX=0 # AIO settings start # Do not remove or change this line! ENV NEXTCLOUD_VERSION=33.0.7 +# Required to stop hadolint from complaining about potentially sensitive data in an environment variable. +# It might be a good idea to reconsider using and env var for this at one point, +# but the actual value here is just a dummy and not relevant, so we silence the warning for now. # hadolint ignore=DL3064 ENV AIO_TOKEN=123456 ENV AIO_URL=localhost