[idea] Run SurfSense in Docker (docker/local) #2100

Which part? Desktop app

What would you like?

Run SurfSense in Docker: the desktop app's stack without Electron, as one container in docker/local/.

• A supervisor shared with Electron runs the API, the workers and the model servers on loopback, over one /data volume.
• Caddy, in the same container, is the only listener. Without a password it answers only localhost; with one it uses basic auth, over HTTPS when a domain is set.
• Images: CPU, -cuda (12.8) and -cuda126 (12.6), on amd64 and arm64.
• The same offline license as the desktop app. One user per install.

Design: Docker proposal, GPU images, ADR 0035. Proposal PR: #2098, with the steps in #2099.

How to help

The work is split into ordered steps, the sub-issues below. Each one depends on the step before it and ends with something that runs. Pick the first open step whose predecessor is merged.

1. Groundwork, safe for the desktop app: steps 1 to 4.
2. The first working container and its CI: steps 5 and 6.
3. Local models, one runtime at a time: steps 7 to 9.
4. Access beyond localhost: steps 10 and 11.
5. GPU images: steps 12 to 14.

The steps are code and tests only. The maintainers write the architecture doc, the README and the AGENTS.md changes once the work ships.

Why would it help?

Self-hosters can run the current app on a server, a NAS or a GPU box. It replaces the legacy self-host images (surfsense-backend, surfsense-web) and their compose stack; the license and scraper API backend is not affected.