Knowledge Base (Posts about docker)

Luanti containers, part 1: Comparing docker-compose and podman-compose rootful

bgstack15 — Thu, 19 Mar 2026 12:50:00 GMT

I currently use Docker to run my Luanti game server and related services. But because I use RHEL derivatives (Rocky Linux, primarily), I wanted to see how the podman tech would work. Here's first post in a short series, explaining the differences in running Luanti in docker versus podman.

Docker-compose

I use docker-compose, so I define all the services in one file. It is very convenient for small scale deployments!

files/2026/listings/luanti-docker-compose.yml (Source)

# File: /home/luanti/game-onyx/docker-compose.yml
# Author: bgstack15
# Startdate: 2026-02-20-6 08:42
# History:
#    2025
# this app in the container will not read the ~/.minetest/minetest.conf, particularly for mcl_keepInventory=true, so I had to modify ~/.minetest/games/mineclonia/minetest.conf
# Reference:
#    https://github.com/linuxserver/docker-luanti
#    https://github.com/minetest-mapserver/mapserver/blob/master/docker-compose.yml
#    https://github.com/minetest-mapserver/mapserver/blob/master/doc/install.md more useful
#    https://github.com/pandorabox-io/pandorabox.io/blob/master/docker-compose.yml#L45-L57
---
version: "3.5"
services:
  luanti:
    image: lscr.io/linuxserver/luanti:latest
    networks:
      - luanti
    environment:
      - PUID=1009
      - PGID=1009
      - TZ=Etc/UTC
      - "CLI_ARGS=--gameid mineclonia --worldname world"
    volumes:
      - /home/luanti/game-onyx/:/config/.minetest
    ports:
      - 30070:30000/udp
    restart: unless-stopped
  mapserver:
    image: ghcr.io/minetest-mapserver/mapserver:latest
    restart: always
    networks:
      - luanti
    volumes:
      - /home/luanti/game-onyx/worlds/world:/minetest
    working_dir: "/minetest"
    ports:
      - 30071:8080/tcp
  ui:
    image: ghcr.io/minetest-go/mtui:latest
    restart: always
    environment:
      WORLD_DIR: "/world"
      LOGLEVEL: debug
      #COOKIE_DOMAIN: "www.example.com"
      #COOKIE_SECURE: "false"
      #COOKIE_PATH: "/games/luanti/namibia/ui"
      SERVER_NAME: "Onyx"
      #WASM_MINETEST_HOST: "minetest"
      API_KEY: "ExampleKeyGoesHere"
      #all features: "api,shell,luashell,minetest_config,docker,modmanagement,signup,chat,minetest_web"
      # enable features does not work. I had to be an admin from minetest.conf `name=<myname>` and then visit webpage and enable shell, luashell, chat
      ENABLE_FEATURES: "shell,luashell,chat"
    volumes:
      - "/home/luanti/game-onyx/worlds/world:/world"
      #- "postgres_socket:/var/run/postgresql"
    networks:
      - luanti
    ports:
      - 30072:8080/tcp
networks:
  luanti:
    name: luanti07
...

I use a third-party image, and not the official Luanti image. The only reason is I found it first on the world wide web. The Mineclonia client side mod does not need anything special in server-side, so any image will suffice.

The environment variables PUID and GUID are specific to this image of Luanti, based on the build team's consistency between all their images.

Even with SELinux enforcing on the docker host, the container doesn't seem to need special selinux tags on the volume mounts :z.

The restart: unless-stopped makes the docker daemon restart these even at reboot.

And, it's a little out of scope here, but the minetest.conf needs to set mapserver.url and mtui.url values to the container names of those other services.

Podman compose rootful

This is the experimental stage for me, and it took me a little while to get it working.

files/2026/listings/luanti-rootful-podman-compose.yml (Source)

# File: /home/luanti/game-onyx/docker-compose.yml
# Author: bgstack15
# Startdate: 2026-02-20-6 08:42
# History:
#    2025
# this app in the container will not read the ~/.minetest/minetest.conf, particularly for mcl_keepInventory=true, so I had to modify ~/.minetest/games/mineclonia/minetest.conf
# Reference:
#    https://github.com/linuxserver/docker-luanti
#    https://github.com/minetest-mapserver/mapserver/blob/master/docker-compose.yml
#    https://github.com/minetest-mapserver/mapserver/blob/master/doc/install.md more useful
#    https://github.com/pandorabox-io/pandorabox.io/blob/master/docker-compose.yml#L45-L57
---
version: "3.5"
services:
  luanti:
    image: lscr.io/linuxserver/luanti:latest
    networks:
      - luanti
    environment:
      - PUID=1009
      - PGID=1009
      - TZ=Etc/UTC
      - "CLI_ARGS=--gameid mineclonia --worldname world"
    volumes:
      # lscr.io image needs ./main-config/minetest.conf
      - /home/luanti/game-onyx/:/config/.minetest/:z
    ports:
      - 30070:30000/udp
      - 30070:30000/tcp
    restart: unless-stopped
  mapserver:
    image: ghcr.io/minetest-mapserver/mapserver:latest
    restart: always
    networks:
      - luanti
    volumes:
      - /home/luanti/game-onyx/worlds/world:/minetest:z
    working_dir: "/minetest"
    ports:
      - 30071:8080/tcp
  ui:
    image: ghcr.io/minetest-go/mtui:latest
    restart: always
    environment:
      WORLD_DIR: "/world"
      LOGLEVEL: debug
      #COOKIE_DOMAIN: "www.example.com"
      #COOKIE_SECURE: "false"
      #COOKIE_PATH: "/games/luanti/namibia/ui"
      SERVER_NAME: "Onyx"
      #WASM_MINETEST_HOST: "minetest"
      API_KEY: "ExampleKeyGoesHere"
      #all features: "api,shell,luashell,minetest_config,docker,modmanagement,signup,chat,minetest_web"
      # enable features does not work. I had to be an admin from minetest.conf `name=<myname>` and then visit webpage and enable shell, luashell, chat
      ENABLE_FEATURES: "shell,luashell,chat"
    volumes:
      - "/home/luanti/game-onyx/worlds/world:/world:z"
      #- "postgres_socket:/var/run/postgresql"
    networks:
      - luanti
    ports:
      - 30072:8080/tcp
networks:
  luanti:
    name: luanti07
...

Of course, install podman and podman-compose.

sudo dnf install -y podman podman-compose
sudo mkdir -p /etc/containers/containers.conf.d
echo "compose_warning_logs=false" | sudo tee /etc/containers/containers.conf.d/60-warnings.conf
sudo groupadd --gid 1009 luanti
sudo useradd --gid 1009 --uid 1009 luanti # I have not set a password
sudo loginctl enable-linger 1009

For the user to work with podman, I had to enable linger. I'm not going to go into the plagued history of this, today. This is necessary for any future podman use by this user, including the upcoming blog posts.

I had to use rootful podman (sudo podman-compose up) because the lscr.io image does some chown operations at initialization, and do not work in rootless mode.

I ran into some selinux problems, or at least I think I did. It certainly didn't hurt me to use the :z selinux option. Lowercase Z means podman should relabel the file objects for multiple containers, but uppercase Z would mean a private, unshared label for just this one container.

Common

The reverse proxy and port forwarding is out of scope for this document.

compiling Darkflame Lego Universe for myself

bgstack15 — Wed, 17 Dec 2025 13:40:00 GMT

I wanted to try to make some code changes to Darkflameserver Lego Universe, which of course necessitates compiling the application.

I cloned the repository and made a branch, and wrote my changes. Of course I used the main branch, instead of whatever commit would have been the last tag. Once I got the compilation process working, my database was migrated to the latest schema.

While my changes worked, I learned that some interim commits which haven't been noticed yet broke the bananas and mermaid head item drops. They do not work at all! That is, none of those items drop, which will completely break the storyline missions. So I then reverted to the correct commit for whatever the last tag was, but my database had already been migrated. Apparently the project changed the datatype for a column for character id. And rather than trying to restore from backup (which I did have), I figured it would be easier to just rebase my commit on top of the commit that had updated that database schema change. That commit came before any of the faffing around with the bananas.

And all this took quite some time, to iterate and realize the problem, and decide the path to rollback.

So the next time I want to implement changes for myself in any project, I will work more carefully with commits.

Docker compose: mount single file as a volume

bgstack15 — Wed, 07 May 2025 12:41:00 GMT

This doesn't always work for me, but it's worth trying. To get a single file mounted inside a docker container as a volume, you have to use the long syntax.

version: "3.7"    
services:
app:
image: app:latest
volumes:
  - type: bind
    source: ./sourceFile.yaml
    target: /location/targetFile.yaml

References

Ripped directly from docker - How to mount a single file in a volume - Stack Overflow

Find exact tag of Docker image

bgstack15 — Fri, 25 Apr 2025 12:37:00 GMT

I had a number of old docker images stored locally and didn't have all the tag info. I think I used ":latest" on most of them, but apparently calling an image that does not mean that every time the container restarts (at host reboot), it fetches the latest one. So some of my images were woefully behind, and as part of a good practice to upgrade to current images for everything, I wanted to know exactly which image I had before, in case I need to roll back.

And apparently there's not a good process for determining that. So I had to write a script to do it for me. And then I had to hack it to work with github container registry which operates differently than docker hub, in this case not as efficiently as docker hub.

We'll start with the script and then I'll explain it.

Running Luanti and Mapserver in different docker-compose files

bgstack15 — Sun, 16 Mar 2025 13:15:00 GMT

I finally got around to setting my Luanti mod mapserver to active mode and send player locations to the mapserver web app.

So you might recall that I use 2 separate docker-compose files so I can take them up and down separately. Well, I needed to put them on the same network. That wasn't too hard.

files/2025/listings/game-docker-compose.yml (Source)

# startdate: 2025-02-27 16:46
# author: bgstack15
# this app in the container uses ~/.minetest/main-config/minetest.conf
# Reference:
#    https://github.com/linuxserver/docker-luanti
#    https://github.com/minetest-mapserver/mapserver/blob/master/docker-compose.yml
#    https://github.com/minetest-mapserver/mapserver/blob/master/doc/install.md more useful
---
version: "3.5"
services:
  luanti:
    image: lscr.io/linuxserver/luanti:latest
    container_name: luanti
    networks:
      - luanti
    environment:
      - PUID=1009
      - PGID=1009
      - TZ=Etc/UTC
      - "CLI_ARGS=--gameid mineclonia --worldname world1"
    volumes:
      - /home/luanti/.minetest:/config/.minetest
    ports:
      - 30000:30000/udp
    restart: unless-stopped
networks:
  luanti:
    name: luanti1
...

files/2025/listings/mapserver-docker-compose.yml (Source)

# startdate: 2025-03-07-6 10:20
# author: bgstack15
# Purpose: Run the map server separately from the game world
# Reference:
#    https://github.com/linuxserver/docker-luanti
#    https://github.com/minetest-mapserver/mapserver/blob/master/docker-compose.yml
#    https://github.com/minetest-mapserver/mapserver/blob/master/doc/install.md more useful
---
version: "3.5"
services:
  mapserver:
    image: ghcr.io/minetest-mapserver/mapserver
    restart: always
    networks:
      - luanti
    volumes:
      - /home/luanti/.minetest/worlds/world1:/minetest
    working_dir: "/minetest"
    ports:
      - 8086:8080/tcp
networks:
  luanti:
    name: luanti1
...

So they clearly have the container use network luanti, and it is aliased to the same-name network. I probably didn't even need to do that, but too late now.

And then I added to my file main-config/minetest.conf the url of the docker internal listening port and container name.

secure.http_mods = mapserver
# hostname for mapserver comes from ~/mapserver/docker-compose.yml with correct network config
mapserver.url = http://mapserver:8080
mapserver.key = IUEXAMPLELTdhxnJ

And then a docker-compose restart for each one later, they were able to share information to each other!

Metube docker-compose full

bgstack15 — Wed, 23 Aug 2023 13:20:06 GMT

# File: docker-compose.yaml
# Project: metube
# Startdate: 2023-01-23
version: "3"
services:
  metube:
    image: alexta69/metube:latest
    container_name: metube
    restart: unless-stopped
    ports:
      - "8081:8081"
    volumes:
      - /mnt/public/Video/Downloads:/downloads
      - /home/metube/.cache:/.cache
    environment:
      # Most of this was suggested by readme. I added restrictfilenames to use only ascii and no spaces
      YTDL_OPTIONS: '{"writesubtitles": true, "subtitleslangs": ["en", "-live_chat"], "postprocessors": [{"key": "Exec", "exec_cmd": "chmod 0664", "when": "after_move"}, {"key": "FFmpegEmbedSubtitle", "already_have_subtitle": false}, {"key": "FFmpegMetadata", "add_chapters": true}], "restrictfilenames": true}'
      # personal preference; I like to include id, which also helps jellyfin
      OUTPUT_TEMPLATE: "%(title)s.%(id)s.%(ext)s"
      # prefix for reverse proxy in httpd metube.cnf
      URL_PREFIX: "/metube"
      # user and group public
      UID: 805300006
      GID: 805300006
  watchtower:
    container_name: watchtower
    image: containrrr/watchtower:latest
    restart: always
    ports:
      - 8082:8080
    command: --interval 86400 metube
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/timezone:/etc/timezone:ro
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_INCLUDE_RESTARTING=true

Of course, the ytdl_options are what I wanted. The .cache mount was to help with some problem with some ffmpeg transcoding operations. I set that /home/metube/.cache to mode 0777, like a noob.

Seven Wonders docker image: use local css and fonts

bgstack15 — Tue, 15 Aug 2023 13:17:42 GMT

Overview

I hacked the seven-wonders docker image to not use external (and potentially-tracking) servers for font and stylesheet assets.

I opened up an issue upstream to see if this is something fixable during the build process to avoid this silliness.

Step by step

I fetched all non-local urls with browser developer tools.

steps taken

These are the steps taken to set up the seven-wonders docker image to use local assets and not leak personal info.

cd /var/www/seven-wonders-assets/
wget 'https://fonts.googleapis.com/css2?family=Acme&display=swap'
# modify css2?f* to use url /seven-wonders-assets/
wget 'https://fonts.gstatic.com/s/acme/v21/RrQfboBx-C5_bx0.ttf'
wget 'https://unpkg.com/normalize.css@%5E7.0.0'
wget 'https://unpkg.com/@blueprintjs/icons@%5E4.13.0/lib/css/blueprint-icons.css'
wget 'https://unpkg.com/@blueprintjs/core@%5E4.15.0/lib/css/blueprint.css'

I found app.jar with sudo ls -al /var/lib/docker/overlay2/*/*/app.jar and finding the exact filesize one that matched from docker exec -it seven_wonders ls -al /app.jar.

get app.jar from sudo cp -pi /var/lib/docker/overlay2/l/JTQPGSF4VGTC4UPZ4W2Y7JUOXI/app.jar ~/foo and with openjdk 17 installed, run:

cd ~/foo
jar xvf app.jar
vi BOOT-INF/classes/static/index.html

and modify it to use /seven-wonders-assets/ paths for all the files. I set css2 to just "css2" and renamed the file to omit the question mark and other parameter-type entries. Its whole contents are as follows.

<!doctype html>
<html lang="en">
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">

   <!-- The .ico is for compatibliity with Safari, which doesn't support SVG -->
   <link rel="icon" href="./favicon.ico" sizes="48x48">
   <link rel="icon" href="./favicon.svg" sizes="any" type="image/svg+xml">

   <title>Seven Wonders</title>
   <link href='/seven-wonders-assets/css2' rel='stylesheet'>
   <!-- Style dependencies -->
   <link href="/seven-wonders-assets/normalize.css@^7.0.0" rel="stylesheet"/>
   <!-- Blueprint stylesheets -->
   <link href="/seven-wonders-assets/blueprint-icons.css" rel="stylesheet"/>
   <link href="/seven-wonders-assets/blueprint.css" rel="stylesheet"/>
 </head>
 <body>
   <div id="root"></div>
   <script src="sw-ui.js"></script>
 </body>
</html>

And now upload the updated file into app.jar

jar -uf app.jar BOOT-INF/classes/static/index.html

And send that file back to where it came from.

sudo cp -pi ~/foo/app.jar /var/lib/docker/overlay2/l/JTQPGSF4VGTC4UPZ4W2Y7JUOXI/app.jar

And restart my docker app, which is a systemd service.

time sudo systemctl restart seven-wonders

And confirm the jar is still updated.

docker exec -it seven_wonders ls -al /app.jar

And now this game works without leaking info to the font and unpkg servers.

Shell hack: docker-nfs-check

bgstack15 — Mon, 07 Aug 2023 15:40:50 GMT

I use docker containers that mount nfs mounts. Sometimes if the docker server comes up before the nfs server does, (and the systemd service dependency definitions don't work), then I want to bounce the services after I've gotten nfs working.

This affects things like my photo app (PhotoPrism) and metube which store files on the network share.

	`#!/bin/sh`
	`# Startdate: 2023-07-18-3 11:00`
	`# File: /usr/local/bin/docker-nfs-check`
	`# Purpose: check nfs`
	`# Usage:`
	`# must define DOCKER_SERVICE to run this. It loads /etc/sysconfig/docker-nfs-check/${DOCKER_SERVICE} file to load the rest of the env vars`
	`LOGFILE=/mnt/public/Support/Systems/server4/var/log/docker-nfs-check/log`
	`exec 3>&1`
	`{`
	`{`
	`{`
	`# initial loading of values`
	`test -z "${DOCKER_SERVICE}" && test -n "${1}" && DOCKER_SERVICE="${1}"`
	`test -z "${DOCKER_SERVICE}" && { printf '%s\n' "Fatal: need DOCKER_SERVICE set to a docker service to load env vars from /etc/sysconfig/docker-nfs-check/\${DOCKER_SERVICE} file." 1>&2 ; exit 1 ; }`
	`if ! test -f "/etc/sysconfig/docker-nfs-check/${DOCKER_SERVICE}" ;`
	`then`
	`printf '%s\n' "Fatal: no file found for /etc/sysconfig/docker-nfs-check/${DOCKER_SERVICE}. Aborted." 1>&2`
	`exit 1`
	`fi`
	`. "/etc/sysconfig/docker-nfs-check/${DOCKER_SERVICE}"`
	`for word in DS_LINES DS_PATH DS_CONTAINER DS_USER DS_SERVICE ;`
	`do`
	`_var="$( eval "echo \$${word}" )"`
	`test -z "${_var}" && { printf '%s\n' "Fatal: need ${word} defined. Aborted." 1>&2 ; exit 1 ; }`
	`done`
	`# main`
	`output="$( sudo su - "${DS_USER}" -s /bin/bash -c "cd ${DS_PATH} ; docker-compose exec ${DS_CONTAINER} mount \| awk \"\\\$5~/nfs/{print \\\$1,\\\$3}\" ;" )"`
	`# output should be ${DS_LINES} lines:`
	`# server3:/var/server3/shares/public/Images/photoprism-imported /photoprism/originals`
	`# server3:/var/server3/shares/public/Images/photos /photoprism/originals/photos`
	`if test "$( echo "${output}" \| wc -l )" != "${DS_LINES}" ;`
	`then`
	`printf '%s\n' "restarting which is missing the nfs mounts."`
	`sudo systemctl restart "${DS_SERVICE}"`
	`else`
	`printf '%s\n' "All good:"`
	`printf '%s\n' "${output}"`
	`fi`
	`} 2>&1 1>&3 \| sed -r -e "s/^/STDERR: /;"`
	`} 3>&1 2>&1`
	`} \| plecho ${DOCKER_SERVICE} \| tee -a "${LOGFILE}"`

It uses my favorite shell redirection spaghetti boilerplate code to prepend STDERR to standard error messages that all end up in the same place.

But inside all that, is the sauce of running the "mount" command and then restarting the docker container if the output is not as expected.

I use shell completion:

# File: /etc/bash_completion.d/docker-nfs-check
# vim: set syntax=sh:
# startdate: 2023-07-18-3 15:45
_docker_nfs_check() {
   local cur prev words cword;
   _init_completion || return
   _tmpfile1="$( mktemp )"
   # populate list
   find /etc/sysconfig/docker-nfs-check  -mindepth 1 -maxdepth 1 ! -type d ! -name '.*' -printf '%P\n' > "${_tmpfile1}"
   COMPREPLY=($( compgen -W "$( cat ${_tmpfile1} )" -- "$cur" ))
   command rm -rf "${_tmpfile1:-NOTHINGTODEL}" 1>/dev/null 2>&1
   return 0
} &&
complete -F _docker_nfs_check docker-nfs-check

And what it does is list the service definitions available in directory /etc/sysconfig/docker-nfs-check/.

# File: /etc/sysconfig/docker-nfs-check/photoprism
# dot-sourced by /usr/local/bin/docker-nfs-check
# To load this file, you must set DOCKER_SERVICE to match this filename.
# su to this user and then
DS_USER="photoprism"
# cd to this path
DS_PATH="/home/photoprism/photoprism"
# to run the docker-compose command on this container name
DS_CONTAINER="photoprism"
# how many lines should return from docker-compose exec ${this_filename} mount | grep nfs
DS_LINES=3
# if the lines are incorrect, restart this systemd service
DS_SERVICE="photoprism.service"

This is indeed a ridiculous hack and work-around, but it works for me. And clearly I'm running out of good blog topics I'm actually going to bother to write.

Newspipe docker image

bgstack15 — Sun, 25 Jun 2023 12:50:20 GMT

I found a new project to tickle my fancy: newspipe! This is a python+flask rss feed aggregator. I had perused the awesome-selfhosted list for a feed manager written in a language I'm familiar with. I was inspired by a fellow netizen's FreeIPA auth plugin for his rss reader.

Because I was just experimenting with this, I didn't want to install it directly to a system. Nor did I want any of the dependencies, like npm or whatever "poetry" is. So I whipped up a docker image for it, which took a lot of trial-and-error. I found only one existing, outdated docker image, for architecture arm7 which doesn't apply to me.

So here is my project: newspipe-docker! I have a dockerfile and also a docker-compose.yml. And yes, I based it on the Devuan image! I wanted ease of development, and not minimum size. I should refactor for that now, though, shouldn't I? Feel free to undertake that for me and let me know.

Next time: I add ldap auth, so I'm not lagging behind the cool kids.

My Photoprism backup process

bgstack15 — Tue, 21 Feb 2023 14:28:39 GMT

I have a customized Photoprism instance. I need to document it more thoroughly, but this is the description of my backup process.

Of course it's in cron. File /etc/cron.d/70_photoprism_cron includes line:

45  06  *  *  *  photoprism   /home/photoprism/photoprism/bup-pp-db.sh cron 1>/dev/null 2>&1

files/2023/02/listings/bup-pp-db.sh (Source)

#!/bin/sh
# File: bup-pp-db.sh
# Locations: vm4:/home/photoprism/photoprism/
# Author: bgstack15
# Startdate: 2023-01-01-1 20:55
# Title: Photoprism backup script
# Purpose: Make single command that bups Photoprism
# History:
# Usage:
#    in cron entry, probably in 
# Documentation:
#    In 2022-12, I moved the directories database/ and storage/ that Photoprism uses back to vm4 local filesystems. To back up the app, I just need to run this script with cron.
#    This process should only just over 1 minute
# Dependencies:
#    photoprism user is in group docker.
#    docker-compose
#    /home/photoprism/photoprism/docker-compose.yml
#    gzip
# Reference:
#    https://docs.photoprism.app/getting-started/advanced/backups/
#    logging heavily inspired by photoprism/autoimport.sh

workdir="$( dirname "$( readlink -f "${0}" 2>/dev/null )" 2>/dev/null || echo "${PWD}" )"
#echo "workdir=${workdir}"
test -z "${CONFFILE}" && CONFFILE="${workdir}/bup-pp-db.conf"
test -e "${CONFFILE}" && . "${CONFFILE}"
test -z "${LOGFILE}" && LOGFILE="/mnt/public/Support/Systems/vm4/var/log/bup-pp-db.$( date "+%F" ).log"

main() {
   which lecho 1>/dev/null 2>&1 || alias lecho=echo
   lecho "START bup-pp-db.sh"
   test -z "${OUTDIR}" && OUTDIR=/mnt/public/Support/Systems/vm4/pp/photoprism
   echo "echo using OUTDIR=${OUTDIR}"
   test "${USER}" != "photoprism" && { echo "For best results, run ${0} as user photoprism. Pausing for 10 seconds..." 2>&1 ; sleep 10 ; }
   # test network mount
   test -w "${OUTDIR}" || { echo "Unable to write to path ${OUTDIR}. Is it mounted? Aborted." ; exit 1 ; }
   # Docker-compose must run from the directory where docker-compose.yml exists
   cd /home/photoprism/photoprism
   docker-compose exec -T photoprism photoprism backup -i - | gzip > "${OUTDIR:-/mnt/public/Support/Systems/vm4/pp/photoprism}/photoprism-db.sql.$( date "+%F" ).gz"
   lecho "STOP bup-pp-db.sh"
}

# Determine if this script was dot-sourced
sourced=0
if [ -n "$ZSH_EVAL_CONTEXT" ]; then 
  case $ZSH_EVAL_CONTEXT in *:file) sourced=1;; esac
elif [ -n "$KSH_VERSION" ]; then
  [ "$(cd $(dirname -- $0) && pwd -P)/$(basename -- $0)" != "$(cd $(dirname -- ${.sh.file}) && pwd -P)/$(basename -- ${.sh.file})" ] && sourced=1
elif [ -n "$BASH_VERSION" ]; then
  (return 0 2>/dev/null) && sourced=1 
else # All other shells: examine $0 for known shell binary filenames
  # Detects `sh` and `dash`; add additional shell filenames as needed.
  case ${0##*/} in sh|dash) sourced=1;; esac
fi

# So, if not dot-sourced, and this is run by cron, add logging
if test $sourced -eq 0;
then
   if echo " ${@} " | grep -q cron ;
   then 
      main 2>&1 | plecho | tee -a "${LOGFILE}"
      printf '\n' | tee -a "${LOGFILE}"
   else
      main
   fi
fi
:

The script refers to a conf file but I don't use one. It's there for easy modification of paths and so on without having to modify the script. Of course, since I'm backing up to a network directory, it checks for the network mount before running the backup command.

Most of the shell script is shell-based wrapping for the bare command

docker-compose exec -T photoprism photoprism backup -i - | gzip > $OUTPUTFILE

which is documented in the Photoprism docs.