Architecture

rCTF ships as a single container managed by supervisord. Inside the container, the Hono API server runs as a Bun process that also spawns the leaderboard worker as a Bun Worker thread. Alongside it, an nginx instance serves the SvelteKit static build and proxies /api and /uploads to the API.

The container sits behind a reverse proxy and connects to PostgreSQL and Redis. The bundled compose.yml starts all three services for a single-server deployment.

For deployment steps, see Installation and the VPS setup walkthrough. The sections below describe the production image itself.

Container layout

The production container has the following layout:

The rctf.d/ and uploads/ directories are mounted from the host by compose.yml. With the default local upload provider, files land under /app/uploads/.

Build stages

The Dockerfile is at deploy/rctf/Dockerfile and uses oven/bun:1.3.14-alpine as both the build and runtime base. The stages:

1
FROM oven/bun:1.3.14-alpine AS runtime-base
2
WORKDIR /app
3

4
# ...
5

6
FROM runtime-base AS production
7

8
RUN apk add --no-cache supervisor nginx nginx-mod-http-brotli
9
COPY deploy/rctf/supervisord.conf /etc/supervisord.conf
10
COPY deploy/rctf/nginx.conf /etc/nginx/http.d/default.conf
11

12
COPY --from=build-api /app/apps/api/dist ./apps/api/dist
13
COPY --from=prod-deps /app/node_modules ./node_modules
14
# ...
15
COPY --from=build-web /app/apps/web/build ./static
16

17
ENV NODE_ENV=production
18
ENV WORKER_EXTENSION=.js
19
CMD ["supervisord", "-c", "/etc/supervisord.conf"]

WORKER_EXTENSION is set to .js so the API process resolves its compiled worker entry (./leaderboard.js) rather than the .ts source used in development.

Process supervision

/etc/supervisord.conf defines two long-running programs. Both stream stdout/stderr to the container’s stdout/stderr without rotation.

1
[program:api]
2
command=/usr/local/bin/bun run /app/apps/api/dist/index.js
3
autostart=true
4
autorestart=true
5
# ...
6

7
[program:nginx]
8
command=/usr/sbin/nginx -g 'daemon off;'
9
autostart=true
10
autorestart=true

If either process exits non-zero, supervisord restarts it. The leaderboard worker is not a separate supervised program. It is a thread inside the API process, so it restarts together with the API.

Nginx

The container’s nginx is built from Alpine’s nginx package together with nginx-mod-http-brotli. The site config at deploy/rctf/nginx.conf is copied to /etc/nginx/http.d/default.conf.

1
server {
2
    listen 80 default_server;
3
    root /app/static;
4
    gzip_static on;
5
    brotli_static on;
6

7
    # ...
8

9
    location ~ ^/api/v[12]/admin/upload$ {
10
        proxy_pass http://127.0.0.1:3000;
11
        client_max_body_size 0;
12
        proxy_request_buffering off;
13
    }
14

15
    location ~ ^/(api|uploads) {
16
        proxy_pass http://127.0.0.1:3000;
17
    }
18

19
    location /_app/immutable/ {
20
        add_header Cache-Control "public, max-age=86400, immutable";
21
        try_files $uri $uri/ /index.html;
22
    }
23

24
    location / {
25
        try_files $uri $uri/ /index.html;
26
    }
27
}

Content Security Policy

CSP is defined in apps/web/svelte.config.ts and applied during the SvelteKit build. The static adapter writes it into each page as a <meta http-equiv="Content-Security-Policy"> tag with hashes for the generated scripts. nginx does not add a separate Content-Security-Policy header.

1
csp: dev
2
  ? undefined
3
  : {
4
      directives: {
5
        'default-src': ['none'],
6
        // ...
7
      },
8
    },

The directives:

The bundled build always includes every origin listed above, even when the corresponding provider is disabled. It cannot add new origins from configuration at runtime. To use self-hosted analytics, a custom S3-compatible service, or another frontend origin, update apps/web/svelte.config.ts and rebuild rCTF.

External dependencies

The container only contains the rCTF application, nginx, and supervisor. Everything else is external.

Optional dependencies that the deployer must supply when the matching provider is enabled:

• S3 / GCS for the uploads/s3 or uploads/gcs upload providers. See Uploads.
• SES, SMTP, or another email provider for the email integration.
• OpenAI (or another moderation provider) for avatar moderation.
• Docker instancer or a Kubernetes cluster running the rCTF k8s-operator for per-team challenge instances. See Instancer.
• Captcha provider (reCAPTCHA, hCaptcha, or Turnstile). The CSP already permits all three.

The bundled compose.yml pins one PostgreSQL and one Redis container alongside rctf. The rctf service exposes 127.0.0.1:8080 and expects a reverse proxy (typically nginx or Caddy on the host) to terminate TLS and forward to it.