The Problem

Running a multi-store, multi-language eCommerce shop means assembling a stack: catalog, cart, CMS, CRM, payments, theming, and search. Smartstore packages those into one ASP.NET Core application so a merchant doesn't glue half a dozen systems together. A fork of the upstream smartstore/Smartstore (1,519 stars), this repo is a full platform rather than a library.

What This Does

Smartstore is a modular eCommerce platform built on ASP.NET Core with Entity Framework Core, Vue.js, Sass, and Bootstrap. The bulk of the code lives in src/Smartstore.Core/, organized by domain (Catalog, Commerce, Content, Platform), with a separate src/Smartstore.Web/ front end. The dev-docs/ folder (122 files) is a substantial developer guide covering architecture, data access, theming, and module creation.

Docker is first-class: docker-compose.yml, docker-compose.postgres.yml, and docker-compose.sqlserver.yml provide database-specific setups, and three Dockerfiles (Dockerfile, Nano.Dockerfile, NoBuild.Dockerfile) cover build variants. CI runs through GitHub Actions (publish-release.yml, publish-nightly.yml, delete-old-workflow-runs.yml). The 143 test files and 146 doc files indicate a maintained project.

How It Is Wired

The detected entry points are tooling assets (tools/Smartstore.WebApi.Client.JavaScript/index.html, tools/Smartstore.IconGenerator/index.html), not the application entry. The main web app entry point (a Program.cs under src/Smartstore.Web/) is not in the provided file listing, so the startup path is unmapped for this repository. What the structure does show: src/Smartstore.Build/ contains Nuke-based build orchestration (Build.cs, Configuration.cs) with MSBuild props/targets that compose modules, and the module system (Smartstore.Module.props, Smartstore.ModuleBuilder/) is the extension mechanism. Domain logic sits in src/Smartstore.Core/ with a Domain folder per feature area, and dev-docs/framework/ documents the service tier, DI, and event/hook patterns.

How To Use It

git clone https://github.com/moses-y/Smartstore
cd Smartstore
# Build and run via Docker (Postgres)
docker compose -f docker-compose.postgres.yml up

Configuration lives in appsettings files under src/Smartstore.Web/, with connection strings per database provider. The build/ scripts (build.win-x64.cmd, build.linux-x64.cmd) wrap the Nuke build. setup-dotnet.sh handles the SDK bootstrap. The README documents the stack as ASP.NET Core 9; the Dockerfile targets mcr.microsoft.com/dotnet/sdk:10.0, so pin the SDK version to match your toolchain.

Real-World Use

A merchant migrating from a monolithic legacy shop deploys Smartstore via the Postgres compose file, imports catalog data through the Web API (dev-docs/framework/web-api/ documents product/order/customer endpoints), and extends it with a custom module by following dev-docs/compose/modules/getting-started-with-modules.md. The theme engine (dev-docs/compose/theming/) allows a white-label front end without touching core code.

Code Health & Issues

Measured analysis (static, not opinion) reports 7 findings: 0 critical, 1 high, 5 medium, 1 low.

  • High - Unpinned third-party GitHub Actions (@v2/@v3 tags) in .github/workflows; a moved tag can run arbitrary code with your token. Fix: pin to commit SHAs.
  • Medium - No permissions declaration in delete-old-workflow-runs.yml; token inherits repo defaults. Fix: add permissions: contents: read.
  • Medium - Docker base images unpinned by digest (dotnet/sdk:10.0, aspnet:10.0); builds drift in libc and CVE exposure. Fix: pin image:tag@sha256:<digest>.
  • Medium - dbip-country-lite.mmdb (7.0MB) committed; every clone pays for it. Fix: Git LFS or object storage.
  • Medium - 12 generated build files committed under build/; stale output can diverge from source. Fix: gitignore, build in CI.
  • Medium - No USER directive in the Dockerfile; container runs as root. Fix: unprivileged user.
  • Low - No timeout-minutes on CI jobs; wedged steps run to platform default. Fix: bound each job.

The repo has tests, CI, license, and no committed secrets. No lockfile is present.

The Bottom Line

A serious, well-documented eCommerce platform with a real module system and Docker support. The health findings are standard hardening work, not structural problems. Suitable for teams needing a self-hosted, multi-tenant shop platform who can invest in CI and container hygiene.