diff --git a/Dockerfile.rootless b/Dockerfile.rootless index 3a0799d8..91ac930e 100644 --- a/Dockerfile.rootless +++ b/Dockerfile.rootless @@ -7,15 +7,15 @@ RUN pnpm install --frozen-lockfile --shamefully-hoist # Build Nuxt FROM node:18-alpine AS frontend-builder -WORKDIR /app -RUN npm install -g pnpm -COPY frontend . +WORKDIR /app +COPY frontend ./ COPY --from=frontend-dependencies /app/node_modules ./node_modules RUN pnpm build +# Build Go dependencies FROM golang:alpine AS builder-dependencies WORKDIR /go/src/app -COPY ./backend . +COPY ./backend/go.mod ./backend/go.sum ./ RUN go mod download # Build API @@ -23,48 +23,51 @@ FROM golang:alpine AS builder ARG BUILD_TIME ARG COMMIT ARG VERSION -RUN apk update && \ - apk upgrade && \ - apk add --update git build-base gcc g++ + +RUN apk update && apk upgrade && apk add --no-cache git build-base gcc g++ WORKDIR /go/src/app COPY ./backend . RUN rm -rf ./app/api/public COPY --from=frontend-builder /app/.output/public ./app/api/static/public COPY --from=builder-dependencies /go/pkg/mod /go/pkg/mod -RUN --mount=type=cache,target=/root/.cache/go-build \ + +# Use cache for Go build +RUN --mount=type=cache,target=/root/.cache/go-build \ CGO_ENABLED=0 GOOS=linux go build \ - -ldflags "-s -w -X main.commit=$COMMIT -X main.buildTime=$BUILD_TIME -X main.version=$VERSION" \ - -o /go/bin/api \ - -v ./app/api/*.go + -ldflags "-s -w -X main.commit=$COMMIT -X main.buildTime=$BUILD_TIME -X main.version=$VERSION" \ + -o /go/bin/api ./app/api/*.go -FROM gcr.io/distroless/java:latest - -# Production Stage +# Production stage with distroless FROM gcr.io/distroless/static:latest ENV HBOX_MODE=production ENV HBOX_STORAGE_DATA=/data/ ENV HBOX_STORAGE_SQLITE_URL=/data/homebox.db?_fk=1 -# Copy the binary and the (empty) /data dir and -# change the ownership to the low-privileged user +# Copy the binary and data directory, change ownership COPY --from=builder --chown=nonroot /go/bin/api /app COPY --from=builder --chown=nonroot /data /data -RUN apk add --no-cache wget +# Add wget to the image +# Note: If using distroless, this may not be applicable +# as distroless images do not include package managers. +# This line may be omitted if you're relying on another way to handle healthchecks. +COPY --from=alpine:latest /bin/wget /usr/bin/wget LABEL Name=homebox Version=0.0.1 LABEL org.opencontainers.image.source="https://github.com/sysadminsmedia/homebox" EXPOSE 7745 + HEALTHCHECK --interval=30s \ --timeout=5s \ --start-period=5s \ --retries=3 \ - CMD [ "/usr/bin/wget", "--no-verbose", "--tries=1", "-O -", "http://localhost:7745/api/v1/status" ] -VOLUME [ "/data" ] + CMD ["/usr/bin/wget", "--no-verbose", "--tries=1", "-O", "-", "http://localhost:7745/api/v1/status"] -# Drop root and run as low-privileged user +VOLUME ["/data"] + +# Drop root and run as a low-privileged user USER nonroot -ENTRYPOINT [ "/app" ] -CMD [ "/data/config.yml" ] +ENTRYPOINT ["/app"] +CMD ["/data/config.yml"]