Picochess with docker and external access from chessnut evo - report

[Dedi Tom]

Hello guys,

Just wanted to share my excitement of been able to create a docker container with picochess and access it remotely from my own domain and have access to all the mame chess engines using my Cheessnut Evo board. No more locked in using few engines provided by the board. I have a very low ELO but and all this new shiny engines are kicking my but.

I do have a Raspberry pi 4 with an LCD that connects to my Chessnut Air as well.

Also been able to connect to picochess from everyone is very exciting.

I did have some issues connecting from a different IP and asked AI to help me fixing. Just wanted to ask if this can solved or picochess is meant  to be used only on local host 127.0.0.0. If you guys think this is possible I will open up an issue on github and share my Dockerfile and docker-compose.yml there as well. I guess this is a temporary solution cause every time I want to update picochess I have to rebuild the docker.

The one thing that doesn't work yet is the retrieval the the Games tab. The app.js is looking at the port 7778 on local host  to communicate this info and I just didn't want to open up another port.

Here is the Dockerfile to see what was need it to modify to make it work:

# ============================================================
# PicoChess - Debian Trixie Docker image
# Source: https://github.com/JohanSjoblom/picochess
# ============================================================
FROM debian:trixie

ENV DEBIAN_FRONTEND=noninteractive
ENV REPO_DIR=/opt/picochess

# System packages
RUN apt-get update && apt-get install -y --no-install-recommends \
    git curl wget ca-certificates unzip tar \
    python3 python3-pip python3-venv python3-dev \
    build-essential gcc pkg-config \
    libffi-dev libssl-dev \
    libglib2.0-dev \
    libtcl8.6 tcl tk \
    sox libsox-fmt-all vorbis-tools \
    libsndfile1 libportaudio2 portaudio19-dev python3-pyaudio \
    libopenblas-dev \
    libsdl2-2.0-0 libsdl2-ttf-2.0-0 \
    telnet i2c-tools rsync vim \
    libgl1 libqt5widgets5t64 \
    alsa-utils libasound2t64 \
    && rm -rf /var/lib/apt/lists/*

# Create pi user
RUN useradd -m -s /bin/bash pi \
    && echo 'pi:password' | chpasswd

# Clone PicoChess
RUN git clone https://github.com/JohanSjoblom/picochess "$REPO_DIR" \
    && chown -R pi:pi "$REPO_DIR"

WORKDIR /opt/picochess

# Python virtualenv and dependencies
RUN python3 -m venv /opt/picochess/venv \
    && /opt/picochess/venv/bin/python -m pip install --upgrade pip setuptools wheel \
    && /opt/picochess/venv/bin/python -m pip install -r requirements.txt

# Config, voices, directories
RUN cp picochess.ini.example-web-$(uname -m) picochess.ini \
    && cp voices-example.ini talker/voices/voices.ini \
    && mkdir -p logs games/uploads \
    && sed -i 's/^web-server = 80/web-server = 8080/' picochess.ini \
    && chown -R pi:pi /opt/picochess

# Install engines and books as pi
USER pi
RUN ./install-engines.sh lite
RUN ./install-books-games.sh

# HTTPS reverse-proxy fix:
# Use wss:// for the /event WebSocket when PicoChess is loaded over HTTPS.
USER root

RUN python3 - <<'PY'
from pathlib import Path

p = Path("/opt/picochess/web/picoweb/static/js/app.js")
if not p.exists():
    print("WARNING: app.js not found - skipping WebSocket patch")
    exit(0)

s = p.read_text()
original = s

old = "new WebSocket('ws://' + location.host + '/event')"
new = (
    "new WebSocket("
    "(location.protocol === 'https:' ? 'wss://' : 'ws://') "
    "+ location.host + '/event')"
)

if old in s:
    s = s.replace(old, new)
    print("Patched WebSocket ws:// -> wss:// for HTTPS")
else:
    print("WARNING: WebSocket line not found - upstream app.js may have changed")

if s != original:
    p.write_text(s)
    print("app.js saved")
else:
    print("No changes made")
PY

# Final permissions
RUN chown -R pi:pi /opt/picochess

# Expose internal PicoChess web port
EXPOSE 8080

USER pi

CMD ["/opt/picochess/venv/bin/python", "/opt/picochess/picochess.py"]

And here is the docker-compose.yml

services:
  picochess:
    build:
      context: .
      dockerfile: Dockerfile

    image: picochess:local
    container_name: picochess
    restart: unless-stopped

    ports:
      # Web UI: host 9191 → container 8080
      - "9191:8080"

    volumes:
      # Main config
      - ./data/picochess.ini:/opt/picochess/picochess.ini
      # Retro MAME engine list
      - ./data/retro.ini:/opt/picochess/engines/x86_64/retro.ini
      # Game PGN files
      - ./data/games:/opt/picochess/games
      # Logs accessible on host
      - ./data/logs:/opt/picochess/logs
      # MAME ROMs
      - ./data/roms:/opt/picochess/engines/mame_emulation/roms

I had to this to my nginx host in the Advance box:

location /event {
    proxy_pass http://10.10.10.10:9191/event;
    proxy_http_version 1.1;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;

    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    proxy_buffering off;
}

[Johan Sjöblom]

Really exciting.  I have tried to make it possible to run picochess on any standard Linux so it should be possible to run it completely in Docker...  It does not require user name to be "pi" either....

Quick answer:

We had cleaned out the BOOKS tab dependency on an external service earlier, I have not yet cleaned up the GAMES tab... If I remember correctly its based on a headless version of SCID vs. PC and maybe we still have some service that provides that on the port you mentioned. Have a look at the install-picochess.sh script and you will see what services it sets up.

Do you know what would be the smallest step to fix your problem for short term? What do we need to have configurable, both ip and port? 

Maybe you just need to have the SCID vs PC running in the same docker plus the configurability you need (port + ip)?

And you should have everything working except the Games tab I guess?... Or? ... Update service will not work without configuration, but you can update manually by using git.
-- Johan

[MartinP]

@Dedi Tom: If the router has built-in WireGuard support, an external connection—such as from a smartphone—using a WireGuard connection should solve this problem. You are effectively on your home network while away and can use localhost (127.0.0.1).