mirror of https://github.com/iv-org/invidious.git
docker: various improvements to Dockerfile
This includes the following changes: - Use multi-stage build to run application in an optimized environment, see https://docs.docker.com/develop/develop-images/multistage-build/ - Run application on alpine instead of archlinux to further reduce image size - Build Crystal application with --release for improved runtime performance - Run application as non-root user for better security, see https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user - Only rebuild Docker layers when required
This commit is contained in:
parent
f99a7b2a8c
commit
ea39bb4334
|
@ -1,15 +1,28 @@
|
||||||
FROM archlinux/base
|
FROM alpine:latest AS builder
|
||||||
|
RUN apk add -u crystal shards libc-dev \
|
||||||
RUN pacman -Sy --noconfirm shards crystal imagemagick librsvg \
|
yaml-dev libxml2-dev sqlite-dev sqlite-static zlib-dev openssl-dev
|
||||||
which pkgconf gcc ttf-liberation glibc
|
|
||||||
# base-devel contains many other basic packages, that are normally assumed to already exist on a clean arch system
|
|
||||||
|
|
||||||
ADD . /invidious
|
|
||||||
|
|
||||||
WORKDIR /invidious
|
WORKDIR /invidious
|
||||||
|
COPY ./shard.yml ./shard.yml
|
||||||
|
RUN shards update && shards install
|
||||||
|
COPY ./src/ ./src/
|
||||||
|
# TODO: .git folder is required for building – this is destructive.
|
||||||
|
# See definition of CURRENT_BRANCH, CURRENT_COMMIT and CURRENT_VERSION.
|
||||||
|
COPY ./.git/ ./.git/
|
||||||
|
RUN crystal build --static --release \
|
||||||
|
# TODO: Remove next line, see https://github.com/crystal-lang/crystal/issues/7946
|
||||||
|
-Dmusl \
|
||||||
|
./src/invidious.cr
|
||||||
|
|
||||||
RUN sed -i 's/host: localhost/host: postgres/' config/config.yml && \
|
FROM alpine:latest
|
||||||
shards update && shards install && \
|
RUN apk add -u imagemagick ttf-opensans
|
||||||
crystal build src/invidious.cr
|
WORKDIR /invidious
|
||||||
|
RUN addgroup -g 1000 -S invidious && \
|
||||||
|
adduser -u 1000 -S invidious -G invidious
|
||||||
|
COPY ./assets/ ./assets/
|
||||||
|
COPY ./config/config.yml ./config/config.yml
|
||||||
|
COPY ./config/sql/ ./config/sql/
|
||||||
|
COPY ./locales/ ./locales/
|
||||||
|
RUN sed -i 's/host: localhost/host: postgres/' config/config.yml
|
||||||
|
COPY --from=builder /invidious/invidious .
|
||||||
|
USER invidious
|
||||||
CMD [ "/invidious/invidious" ]
|
CMD [ "/invidious/invidious" ]
|
||||||
|
|
Loading…
Reference in New Issue