mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
0f029d6b02
Now that the release workflow publishes musl binaries, the runtime image can drop the debian:trixie-slim base for alpine:3.22. The image shrinks from ~287 MB to ~96 MB (66% smaller) with a smaller attack surface. - Dockerfile: alpine:3.22 base, apk packages (ca-certificates git tini su-exec), BusyBox adduser/addgroup, tini at /sbin/tini. - entrypoint.sh: replace runuser with su-exec, Alpine's idiomatic drop-privileges helper. - release.yml docker job: pull the two linux-musl artifacts instead of linux-gnu. The docker image and the Alpine install.sh path now ship the same binary. - bin/dev/docker-build.sh: compile fabro-cli for the host's musl target in rust:1-bookworm with musl-tools, the matching CC/LINKER env vars, and LIBZ_SYS_STATIC=1. Same pattern as CI. Verified locally on aarch64: Alpine image builds, server binds on $PORT (default 32276), endpoints return 200, fabro server process runs as unprivileged UID 1000 under tini. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
40 lines
1.3 KiB
Docker
40 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1.9
|
|
#
|
|
# Runtime image for the Fabro server.
|
|
#
|
|
# Binaries are supplied pre-built via the release workflow:
|
|
# docker-context/amd64/fabro (x86_64-unknown-linux-musl)
|
|
# docker-context/arm64/fabro (aarch64-unknown-linux-musl)
|
|
#
|
|
# The image serves the HTTP API (with embedded web UI) on $PORT (default
|
|
# 32276), persists state to /storage, and runs as the unprivileged `fabro`
|
|
# user. Honoring $PORT lets PaaS providers (Railway, Fly, Render, Heroku,
|
|
# Cloud Run) route traffic without extra configuration.
|
|
|
|
FROM alpine:3.22
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
git \
|
|
su-exec \
|
|
tini \
|
|
&& addgroup -S -g 1000 fabro \
|
|
&& adduser -S -u 1000 -G fabro -h /var/fabro -s /sbin/nologin fabro \
|
|
&& install -d -o fabro -g fabro -m 0755 /var/fabro /storage \
|
|
&& install -d -m 0755 /etc/fabro
|
|
|
|
COPY --chmod=0755 docker-context/${TARGETARCH}/fabro /usr/local/bin/fabro
|
|
|
|
COPY docker/settings.toml /etc/fabro/settings.toml
|
|
COPY --chmod=0755 docker/entrypoint.sh /usr/local/bin/fabro-entrypoint
|
|
|
|
ENV FABRO_HOME=/var/fabro \
|
|
FABRO_CONFIG=/etc/fabro/settings.toml
|
|
|
|
VOLUME ["/storage"]
|
|
EXPOSE 32276
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/fabro-entrypoint"]
|
|
CMD ["sh", "-c", "exec fabro server start --foreground --bind 0.0.0.0:${PORT:-32276}"]
|