mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-22 00:31:12 +00:00
8e4693ad8c
Runtime image now builds FROM ghcr.io/fabro-sh/dhi-alpine-base (Docker
Hardened Images mirror, Alpine 3.23) instead of alpine:3.22. Same
runtime shape, CVE-minimized base. Changelog updated to reflect the
DHI migration.
bin/dev/docker-build.sh grows --arch {amd64,arm64} and --compile-only
flags so local multi-arch verification works regardless of host arch.
Cargo target cache is now per-arch to prevent arm64/amd64 artifacts
from stomping each other in one shared volume.
42 lines
1.3 KiB
Docker
42 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1.9
|
|
#
|
|
# Runtime image for the Fabro server.
|
|
#
|
|
# Binaries are supplied pre-built via the release workflow:
|
|
# docker-context/amd64/fabro (x86_64-unknown-linux-musl)
|
|
# docker-context/arm64/fabro (aarch64-unknown-linux-musl)
|
|
#
|
|
# The image serves the HTTP API (with embedded web UI) on $PORT (default
|
|
# 32276), persists state to /storage, and runs as the unprivileged `fabro`
|
|
# user. Honoring $PORT lets PaaS providers (Railway, Fly, Render, Heroku,
|
|
# Cloud Run) route traffic without extra configuration.
|
|
|
|
FROM ghcr.io/fabro-sh/dhi-alpine-base:3.23-dev-2026-04-18
|
|
|
|
USER root
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
git \
|
|
su-exec \
|
|
tini \
|
|
&& addgroup -S -g 1000 fabro \
|
|
&& adduser -S -u 1000 -G fabro -h /var/fabro -s /sbin/nologin fabro \
|
|
&& install -d -o fabro -g fabro -m 0755 /var/fabro /storage \
|
|
&& install -d -m 0755 /etc/fabro
|
|
|
|
COPY --chmod=0755 docker-context/${TARGETARCH}/fabro /usr/local/bin/fabro
|
|
|
|
COPY docker/settings.toml /etc/fabro/settings.toml
|
|
COPY --chmod=0755 docker/entrypoint.sh /usr/local/bin/fabro-entrypoint
|
|
|
|
ENV FABRO_HOME=/var/fabro \
|
|
FABRO_CONFIG=/etc/fabro/settings.toml
|
|
|
|
VOLUME ["/storage"]
|
|
EXPOSE 32276
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/fabro-entrypoint"]
|
|
CMD ["sh", "-c", "exec fabro server start --foreground --bind 0.0.0.0:${PORT:-32276}"]
|