43 lines
2.0 KiB
Docker
43 lines
2.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
FROM golang:1.26-alpine AS build
|
|
WORKDIR /src
|
|
|
|
# Dependencies first so edits to the source don't re-download the module cache.
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
RUN mkdir -p /out/releases /out/logs
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false \
|
|
-ldflags="-s -w" -o /out/memby-server ./cmd/memby-server
|
|
# The credits bench ships in the image because the number it prints is only meaningful
|
|
# against the household's own media on its own hardware — a figure measured anywhere else
|
|
# proves nothing about whether a scan on this NAS is cheap.
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -buildvcs=false \
|
|
-ldflags="-s -w" -o /out/memby-credits ./cmd/memby-credits
|
|
|
|
# Alpine rather than distroless/static, and the reason is ffmpeg.
|
|
#
|
|
# Credits detection is the only thing in the gateway that reads media bytes, and it does so
|
|
# through ffmpeg used surgically — seek to the tail, downscale to a thumbnail, one frame every
|
|
# few seconds, raw grayscale on stdout, nothing written to disk. A static distroless image
|
|
# cannot carry a decoder, so the choice is this base or no visual detection at all.
|
|
#
|
|
# What is preserved from distroless: CA certificates, so an HTTPS Emby is reachable, and a
|
|
# non-root user. What is given up: about a hundred megabytes, and a shell existing in the
|
|
# image. The container healthcheck still re-runs the binary with -healthcheck rather than
|
|
# using curl, so it is unchanged by the move and stays honest if the base ever goes back.
|
|
FROM alpine:3.21
|
|
RUN apk add --no-cache ca-certificates ffmpeg \
|
|
&& addgroup -g 65532 -S nonroot \
|
|
&& adduser -u 65532 -S -G nonroot nonroot
|
|
WORKDIR /app
|
|
COPY --from=build /out/memby-server /app/memby-server
|
|
COPY --from=build /out/memby-credits /app/memby-credits
|
|
COPY --from=build --chown=nonroot:nonroot /out/releases /data/releases
|
|
COPY --from=build --chown=nonroot:nonroot /out/logs /data/logs
|
|
EXPOSE 8080
|
|
USER nonroot:nonroot
|
|
ENTRYPOINT ["/app/memby-server"]
|