fjudith / docker-draw.io

Dockerized draw.io based on tomcat:9-jre11 & tomcat:9-jre8-alpine official image.

latest alpine

Introduction

draw.io (formerly Diagramly) is free online diagram software. You can use it as a flowchart maker, network diagram software, to create UML online, as an ER diagram tool, to design database schema, to build BPMN online, as a circuit diagram maker, and more. draw.io can import .vsdx, Gliffy™ and Lucidchart™ files.

In this repository:

• draw.io docker image that is always up-to-date with draw.io releases
• draw.io export server image which allow exporting draw.io diagrams to pdf and images
• docker-compose to run draw.io with the export server
• docker-compose to run draw.io integrated within nextcloud
• docker-compose to run draw.io with PlantUML support
• docker-compose to run draw.io self-contained without any dependency on draw.io website (with the export server, plantUml, Google Drive support, OneDrive support, and EMF conversion support (for VSDX export)

Description

The Dockerfile builds from tomcat:9-jre11-slim and tomcat:9-jre8-alpine (see https://hub.docker.com/_/tomcat/)

Forked from fjudith/draw.io

Features

• Based on Tomcat so it can be used directly or behind a reverse-proxy
• Self-Signed certificate autogen
• Let's encrypt certificate autogen
• Support SSL Keystore mount to /user/local/tomcat/.keystore

Quick Start

Run the container.

docker run -it --rm --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io

Start a web browser session to http://localhost:8080/?offline=1&https=0 or https://localhost:8443/?offline=1

If you're running Docker Toolbox then start a web browser session to http://192.168.99.100:8080/?offline=1&https=0 or https://192.168.99.100:8443/?offline=1

?offline=1 is a security feature that disables support of cloud storage.

Environment variables

• LETS_ENCRYPT_ENABLED: Enables Let's Encrypt certificate instead of self-signed; default false
• PUBLIC_DNS: DNS domain to be used as certificate "CN" record; default draw.example.com
• ORGANISATION_UNIT: Organisation unit to be used as certificate "OU" record; default Cloud Native Application
• ORGANISATION: Organisation name to be used as certificate "O" record; default example inc
• CITY: City name to be used as certificate "L" record; default Paris
• STATE: State name to be used as certificate "ST" record; default Paris
• COUNTRY_CODE: Country code to be used as certificate "C" record; default FR
• KEYSTORE_PASS: ".keystore"/.jks" store password; default V3ry1nS3cur3P4ssw0rd
• KEY_PASS: Private key password; default <ref:KEYSTORE_PASS>

HTTPS SSL Certificate via Let's Encrypt

Prerequisites:

1. A Linux machine connected to the Internet with ports 443 and 80 open
2. A domain/subdomain name pointing to this machine's IP address. (e.g., drawio.example.com)

Method:

1. Using jgraph/drawio docker image, run the following command docker run -it -m1g -e LETS_ENCRYPT_ENABLED=true -e PUBLIC_DNS=drawio.example.com --rm --name="draw" -p 80:80 -p 443:8443 jgraph/drawio Notice that mapping port 80 to container's port 80 allows certbot to work in stand-alone mode. Mapping port 443 to container's port 8443 allows the container tomcat to serve https requests directly.

Changing draw.io configuration

Method 1 (Build you custom image with setting pre-loaded)

1. Edit PreConfig.js & PostConfig.js files (next to Dockerfile in debian or alpine folders)
2. Build the docker image

Method 2 (Using existing running docker container)

1. Edit PreConfig.js & PostConfig.js files (next to Dockerfile in debian or alpine folders)
2. Copy these files to docker container

docker cp PreConfig.js draw:/usr/local/tomcat/webapps/draw/js/
docker cp PostConfig.js draw:/usr/local/tomcat/webapps/draw/js/

Method 3 (Bind configuration files into the container when started)

1. This method allows changing the configuration files directly on the host without invoking any other docker commands. It can be used for testing
2. Edit PreConfig.js & PostConfig.js files (next to Dockerfile in debian or alpine folders)
3. From within the directory that contained the configuration files, run the following command to start docker container
4. Note: self-contained docker-compose file already mount the configuration files into the container

docker run -it  --rm --name="draw" --mount type=bind,source="$(pwd)"/PreConfig.js,target=/usr/local/tomcat/webapps/draw/js/PreConfig.js --mount type=bind,source="$(pwd)"/PostConfig.js,target=/usr/local/tomcat/webapps/draw/js/PostConfig.js -p 8080:8080 -p 8443:8443 fjudith/draw.io

Reference

• https://github.com/jgraph/draw.io

docker-draw.io's Issues

Configuration

Hi,

As a good newbie with Docker, I follow the steps to install/start it. I used "docker run -it --rm --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io"

Now I wish make French default langage but is there a way to include this parameter when running the pod ?
Someone would like to be a good teacher to me please ?

Thank You
Arno

Option for "container" storage

would it be possible to add an option for "Container" storage. Using Device or Browser works well for individuals however it doesn't work well for collaboration. I'd like to have an instance of a DrawIO container running with a PersistentVolume or Docker Mount point so other users can connect to the instance and work on the same drawings with little configuration changes.

catalina.out missing

Currently i know logs is localhost_access_log.log , catalina.log in logs Directory

but The console.log is not checked anywhere.

I'm sorry, but can you please let me know?

DRAWIO_BASE_URL parameter not working with bind-mounted PreConfig.js & reverse proxy

Base URL customization per this issue is not working, the following files still attempt to load from the root instead of the noted subdirectory (/diagram):
croppie.min.css
grapheditor.css
PreConfig.js
apple-touch-icon.png
favicon-16x16.png

Nginx location block

location /diagram { # begin diagram block
        auth_request /auth-4;
        proxy_pass  https://diagram-url:8443/;
        add_header X-Frame-Options "SAMEORIGIN";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
} 

Docker-compose.yml

version: '3.5'
services:
  drawio:
    image: fjudith/draw.io
    container_name: drawio
    restart: unless-stopped
    ports:
      - 8080:8080
      - 8443:8443
    environment:
      PUBLIC_DNS: example.org
    volumes:
      - ./config/PreConfig.js:/usr/local/tomcat/webapps/draw/js/PreConfig.js

PreConfig.js

/**
 * Copyright (c) 2006-2019, JGraph Ltd
 * Copyright (c) 2006-2019, draw.io AG
 */
// Overrides of global vars need to be pre-loaded
window.EXPORT_URL = '/export'; //This points to ExportProxyServlet which uses the local export server at port 8000.
//This proxy configuration allows https requests to the export server via Tomcat.
window.PLANT_URL = 'REPLACE_WITH_YOUR_PLANTUML_SERVER';
// window.DRAWIO_BASE_URL = 'https://mcp.lunacite.com/diagram';
// window.DRAWIO_VIEWER_URL = 'https://mcp.lunacite.com/diagram/js/viewer.min.js';
window.DRAW_MATH_URL = 'math';
window.DRAWIO_CONFIG = null; //Replace with your custom draw.io configurations. For more details, https://desk.draw.io/support/solutions/articles/16000058316

typo in docker command - documentation

docker run -it --rm --name="draw" -p 8080:8080 -p 8443:8443 jgraph/draw.io
this image doesnt exist because you put dot between words draw and io.
Please fix doc.

ssl error when accessing with firefox

Hi,

I can't access the drawio app. Broser gives me an ssl error that i can not easily workaround

docker run -it --rm --name="draw" -p 8080:8080 fjudith/draw.io

firefox to -> https://localhost:8080/draw/?offline=1

=>

Secure Connection Failed

An error occurred during a connection to localhost:8080. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

Learn more…

Typo in Dockerfile

Hello,

We have discovered a typo in your docker file that seems to be preventing the war/plugins/embed2js.patch from being included.

The Dockerfile should be :

patch -p1 < war/plugins/embed2js.patch

but is:

patch -p1 war/plugins/embed2js.patch

Chris

just to be sure

You said that draw.io is enforcing https
Did you import haproxy in your docker container which we can download? Or do we need to add it separately?
Sorry I never used a proxy before.
So the proxy will redirect the http to https? And so if we open the 8080 port it-s only to give it access to the proxy ?

Debian base image "tomcat:9-jre11-slim" causes CVE-2019-2201 vulnerability in AWS ECR

The debian/Dockerfile builds from the base image "tomcat:9-jre11-slim", but it is warned CRITICAL level as CVE-2019-2201 vulnerability by AWS ECR scanner. Debian looks taking no action on that. I am not sure it is because there may be no actually critical impact (may be because it is an android issue?), but anyway it may be good to take any work around the critical-alert by ECR.

When I changed it to "tomcat:9-jdk11-openjdk-slim", then the 1 critical was disappeared. Do you agree to change to this image to work around ECR critical signal?

Uncaught TypeError: Cannot read properties of null (reading 'hideTooltip')

The error occurred when I created a blank diagram on my self-hosted draw.io.

By the way, it is fine when I use the IP:Port to access the self-hosted draw.io services.

link URLs remain app.diagram.net when running on localhost:8080

Spawning up drawio using docker-compose running locally on http://localhost:8080 works great.

However when 'File > Export as > URL' then the URL will start as https://app.diagram.net/?lightbox... .
Expectation is that the URL starts as http://localhost:8080/?lightbox... .

When changing the URL manually to localhost:8080 the diagram shows perfectly fine.

Considering the goal of providing the highest data privacy and security for customers who want to keep their data within their infrastructure, could this be fixed?

Why can't local files be saved in real time？

Every time you save it, the browser automatically downloads it to the local location instead of saving it automatically. Why?

Can I increase en environment variable to make the docker container support the default language setting?

Just like the title, if not, would you consider supporting this feature.

thanks for developing this!

Image jgraph/drawio vs fjudith/draw.io in self-contained/ docker compose

Dear,

I wondered why debian/Dockerfile generated docker process had an error as follows when I accessed it from my browser:

Access to XMLHttpRequest at 'https://rt.draw.io/cache?alive' from origin 'https://localhost:8443' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains the invalid value 'https:/'.

...while self-contained/docker-compose.yml didn't.

What I find out is that the image is different. The former is latest built locally while the latter is https://hub.docker.com/r/jgraph/drawio

Unfortunately, the latter doesn't show Dockerfile so that I wonder how it is built.

Could you let me know how to fix this CORS error in either:

a) by fixing drawio itself
b) by knowing how to build jgraph/drawio
c) any other?

Thank you and best regards,

How to set env var for private gitlab repo

jgraph/drawio#493 (comment)

ver 11.1.2 support define private gitlab repo, but how to use it in docker image?

I tried both in docker-compose and Dockerfile but not work

environment:
  DRAWIO_GITLAB_URL: http://xxx:8989/gitlab
 DRAWIO_GITLAB_ID:a8ef2e21acff13f734127b0cbfe6a22e5302095630b2378a39f33239d9b459b7

why chrome display "Unsaved changes. Click here to save" when saving a file

UUID in server.xml may be invalid

If the UUID generated in docker-entrypoint.sh begins with a number, it results in an illegal XML element name (XML elements cannot begin with a number).

The result is that sometimes when you start the container, the following errors appear:

Append https connector to server.xml
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Invalid expression: /Server/Service/3iSCTQuE
Using CATALINA_BASE:   /usr/local/tomcat
Using CATALINA_HOME:   /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME:        /docker-java-home/jre
Using CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
01-Dec-2017 21:00:19.961 WARNING [main] org.apache.catalina.core.StandardContext.setPath A context path must either be an empty string or start with a '/' and do not end with a '/'. The path [/] does not meet these criteria and has been changed to []
01-Dec-2017 21:00:19.980 SEVERE [main] org.apache.tomcat.util.digester.Digester.fatalError Parse Fatal Error at line 224 column 4: The content of elements must consist of well-formed character data or markup.
 org.xml.sax.SAXParseException; systemId: file:/usr/local/tomcat/conf/server.xml; lineNumber: 224; columnNumber: 4; The content of elements must consist of well-formed character data or markup.
...

The UUID should be generated with a format that does not allow a numeric value as the first character.

cloud options

I guess there is no way to make the ondrive, dropbox and google drive work, is it ? or maybe I should it 's not the fault of the docker container but more of the draw.io github?

Blank screen javascript error

On first run inside docker, i see a javascript error for offline mode.
If I remove offline=1, it works.

http://xxxxxxxxx:8280/?offline=1

(8080 -> 8280, no https)

app.min.js:8540
Uncaught ReferenceError: applicationCache is not defined
at App.EditorUi.updateUi (app.min.js:8540)
at new App (app.min.js:8931)
at app.min.js:8942
at app.min.js:194
at mxXmlRequest. (app.min.js:276)
at XMLHttpRequest. (app.min.js:179)

Using: fjudith/draw.io:latest@sha256:4f8bdbaebf7823e66e6289fea4df16093fbb365da1a4d8ab5abac2e82a7887c4

Missing Graphics for BPMN Gateways and BPMN Events when using offline mode

I just started a new docker instance using the instructions -> docker run -it --rm --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io

i later stumbled upon missing graphics.

BPMN Gateways and BPMN Events do only show white boxes in the left selection Menu

Screenshot:

However those icons do appear when i no not use the offline parameter

GitLab custom URL not respected

I run docker-compose after cloning this repo. Draw.io starts and run on localhost:8080.
The docker log for draw.io display:

Init config.js
window.DRAWIO_GITLAB_URL = 'http://mygitlab.net';
window.DRAWIO_GITLAB_ID = 'change_to_your_app_id';

Choosing Gitlab as target for storing files and selecting authorize. Still redirecting me to gitlab.com

Push versions from draw.io repo

Would it be useful to push the version to this repo when new draw.io releases are built?

Secure Draw.io with username and password

I want to create a domain name for draw.io but i will only do that if i can secure the app with a username and password.
Is there a way to do that?
If not i will only run it locally

By the way, i'm not sure if this is an issue. To me its more like a question.

ARM Version?

I'd love to run this on a Raspberry Pi, which needs an ARM64 version of the container... Would this be possible?

Thanks!

Readonly

I try to run as many images as possible read-only to reduce the chances of being hacked. It would be nice if there were an option to completely disable TLS and the generation of the keystore file via environment variables. I do my TLS termination in another container and don't need/want the JVM to do it.

I run my draw.io container with a tmpfs at /usr/local/tomcat/work/Catalina/localhost to keep Tomcat happy, and I copied a .keystore out to my host filesystem and mount it into the container at /usr/local/tomcat/.keystore as a temporary workaround.

Thanks for the fantastic image!

Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Multiple Vulnerabilities

Can we update the apache tomcat to > 9.0.31 - or best to latest 9.0.46?

not working

first your readme is wrong since we need to had draw in the url because if we do not we go to a tomcat test page.

Second if I go to draw/ I have a ssl problem and not the same one as the previous issue.
ERR_SSL_PROTOCOL_ERROR
Is it because I'm not using it in localhost but from a distant point in the LAN? Does your container only work in loop?

Offline redirection

Would be possible to have the server configured to set the param ?offline=1 automatically?
Maybe with some env variable