Dockerfile (1)

43-49: Document the passwordless sudo usage and its implications for dev containers.

Granting passwordless sudo to the ivorysql user is acceptable for development containers but should be documented or accompanied by a security note. In production or shared environments, this would be inappropriate.

Recommendation: Add a comment in the Dockerfile explaining that this is intended for development only and should not be replicated in production images. Consider adding this detail to the README's Docker section as well.

Apply this diff to add clarifying comments:

 # Create ivorysql user with matching host UID/GID (1000:1000)
-# and grant sudo privileges without password
+# and grant sudo privileges without password (dev container only)
 ARG USER_UID=1000
 ARG USER_GID=1000
 RUN groupadd -g ${USER_GID} ivorysql || true && \
     useradd -m -u ${USER_UID} -g ${USER_GID} -d /home/ivorysql -s /bin/bash ivorysql && \
+    # WARNING: Passwordless sudo is only suitable for development containers
     echo "ivorysql ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

docker-compose.yaml (2)

1-1: Add compose file version for explicit API contract.

While Docker Compose works without a version field, explicitly specifying the version ensures compatibility and makes the file's API contract clear.

Apply this diff to add the version field:

+version: '3.8'
+
 services:

---

13-16: Consider using environment variables for Oracle password and consider image freshness.

The hardcoded password and specific Oracle image tag have trade-offs:

• Password management: Hardcoding orapwd is acceptable for dev containers, but consider using a .env file or environment variable pattern for consistency with other projects and to enable easy customization without editing the compose file.
• Image versioning: The pinned tag 23.26.0.0-lite ensures reproducibility, but Oracle Container Registry tags may change or become unavailable. Consider documenting the image freshness requirement or using a more stable tag strategy.

Apply this diff to use environment variables:

  oracle:
    image: container-registry.oracle.com/database/free:23.26.0.0-lite
    environment:
-      ORACLE_PWD: orapwd
+      ORACLE_PWD: ${ORACLE_PWD:-orapwd}

Then create a .env file (or document in README) with:

ORACLE_PWD=orapwd

README.md (1)

34-63: Docker development documentation is well-structured and comprehensive.

The new "Development with Docker" section provides clear, step-by-step instructions with practical examples. The workflow covers configuration, building, initialization, startup, and testing—all essential for developers onboarding to the project.

Recommendation: Consider adding a note about system requirements (e.g., minimum Docker version, minimum disk space for Oracle Free Database image which can be ~6-7 GB) in the Quick Start section to prevent user surprises.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

.devcontainer/Dockerfile (1)

47-47: Avoid silently masking errors with || true unless the failure is expected and safe to ignore.

Line 47 uses || true to suppress all groupadd errors, including unexpected ones. This could mask real problems (e.g., permission issues, invalid arguments). If the intent is to idempotently handle existing groups, be explicit about which error to ignore.

-RUN groupadd -g ${USER_GID} ivorysql || true && \
+# Create group if it doesn't exist; ignore "already exists" error
+RUN groupadd -g ${USER_GID} ivorysql 2>/dev/null || true && \

Alternatively, use a more robust pattern:

-RUN groupadd -g ${USER_GID} ivorysql || true && \
+RUN ! getent group ivorysql >/dev/null && groupadd -g ${USER_GID} ivorysql || true && \

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro