invidious-copy-2022-04-11/docker/Dockerfile

FROM crystallang/crystal:0.36.1-alpine AS builder
RUN apk add --no-cache curl sqlite-static yaml-static
WORKDIR /invidious
COPY ./shard.yml ./shard.yml
COPY ./shard.lock ./shard.lock
RUN shards install && \
    curl -Lo ./lib/lsquic/src/lsquic/ext/liblsquic.a https://github.com/iv-org/lsquic-static-alpine/releases/download/v2.18.1/liblsquic.a
COPY ./src/ ./src/
# TODO: .git folder is required for building – this is destructive.
# See definition of CURRENT_BRANCH, CURRENT_COMMIT and CURRENT_VERSION.
COPY ./.git/ ./.git/
RUN crystal build ./src/invidious.cr \
    --static --warnings all \
    --link-flags "-lxml2 -llzma"

FROM alpine:latest
RUN apk add --no-cache librsvg ttf-opensans
WORKDIR /invidious
RUN addgroup -g 1000 -S invidious && \
    adduser -u 1000 -S invidious -G invidious
COPY --chown=invidious ./assets/ ./assets/
COPY --chown=invidious ./config/config.* ./config/
RUN mv -n config/config.example.yml config/config.yml
RUN sed -i 's/host: \(127.0.0.1\|localhost\)/host: postgres/' config/config.yml
COPY --chown=invidious ./config/sql/ ./config/sql/
COPY --chown=invidious ./locales/ ./locales/
COPY --from=builder /invidious/invidious .

EXPOSE 3000
USER invidious
CMD [ "/invidious/invidious" ]
-												Update to Crystal 0.36.1

											
										
										
											2021-02-04 04:13:29 +00:00
+								FROM crystallang/crystal:0.36.1-alpine AS builder
-												Add yaml-static as build dependency
											
										
										
											2021-03-17 17:59:02 +00:00
+								RUN apk add --no-cache curl sqlite-static yaml-static
-												basic docker-compose cluster

											
										
										
											2018-09-26 07:46:08 +00:00
+								WORKDIR /invidious
-												Verify download, fix invidious file permission (#949)

* Fix docker
											
										
										
											2020-05-01 01:35:34 +00:00
+								COPY ./shard.yml ./shard.yml
-												Untrack config.yml (#1557)

* Untrack config.yml

`config/config.yml` has been untracked and moved to `config/config.example.yml`.

The Dockerfile has been updated to copy all `config/config.*` files and to try
to move `config/config.example.yml` to `config/config.yml`. If a user supplied
`config/config.yml` exists it is not overwritten.

* Update Dockerfile to use `shard.lock`

* Fix tests
											
										
										
											2020-12-10 07:18:30 +00:00
+								COPY ./shard.lock ./shard.lock
-												Revert "Bump dependencies"

This reverts commit abe283b38e7dcca46d0421af005594f574243a30.

											
										
										
											2021-03-13 21:14:27 +00:00
+								RUN shards install && \
 								    curl -Lo ./lib/lsquic/src/lsquic/ext/liblsquic.a https://github.com/iv-org/lsquic-static-alpine/releases/download/v2.18.1/liblsquic.a
-												docker: various improvements to Dockerfile

This includes the following changes:

- Use multi-stage build to run application in an optimized environment, see
  https://docs.docker.com/develop/develop-images/multistage-build/
- Run application on alpine instead of archlinux to further reduce image size
- Build Crystal application with --release for improved runtime performance
- Run application as non-root user for better security, see
  https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
- Only rebuild Docker layers when required

											
										
										
											2019-08-01 10:49:12 +00:00
+								COPY ./src/ ./src/
 								# TODO: .git folder is required for building – this is destructive.
 								# See definition of CURRENT_BRANCH, CURRENT_COMMIT and CURRENT_VERSION.
 								COPY ./.git/ ./.git/
-												Proper fix for docker build

return to static linking
											
										
										
											2019-11-26 23:20:23 +00:00
+								RUN crystal build ./src/invidious.cr \
-												Switch to official crystallang alpine image (#1247)

* Switch to official crystal-lang alpine image
											
										
										
											2020-06-16 23:04:41 +00:00
+								    --static --warnings all \
-												Proper fix for docker build

return to static linking
											
										
										
											2019-11-26 23:20:23 +00:00
+								    --link-flags "-lxml2 -llzma"
-												basic docker-compose cluster

											
										
										
											2018-09-26 07:46:08 +00:00
-												Proper fix for docker build

return to static linking
											
										
										
											2019-11-26 23:20:23 +00:00
+								FROM alpine:latest
-												Remove dependency on ImageMagick (replace with rsvg-convert)

											
										
										
											2019-10-28 14:46:59 +00:00
+								RUN apk add --no-cache librsvg ttf-opensans
-												Proper fix for docker build

return to static linking
											
										
										
											2019-11-26 23:20:23 +00:00
+								WORKDIR /invidious
-												docker: various improvements to Dockerfile

This includes the following changes:

- Use multi-stage build to run application in an optimized environment, see
  https://docs.docker.com/develop/develop-images/multistage-build/
- Run application on alpine instead of archlinux to further reduce image size
- Build Crystal application with --release for improved runtime performance
- Run application as non-root user for better security, see
  https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
- Only rebuild Docker layers when required

											
										
										
											2019-08-01 10:49:12 +00:00
+								RUN addgroup -g 1000 -S invidious && \
 								    adduser -u 1000 -S invidious -G invidious
-												Set correct permissions in Dockerfile

When having a `umask` of `xx7` (e.g. `027`) on the host machine then the directories `assets`, `config` and `locales` don't become readable to the `invidious` user inside the Docker container since the `COPY` commands result in files owned by `root` with the same file permissions like on the host (`640` in my case).

By adding `--chown=invidious` to the `COPY` command we ensure the `invidious` user can read these files.
											
										
										
											2021-05-05 08:16:11 +00:00
+								COPY --chown=invidious ./assets/ ./assets/
-												Untrack config.yml (#1557)

* Untrack config.yml

`config/config.yml` has been untracked and moved to `config/config.example.yml`.

The Dockerfile has been updated to copy all `config/config.*` files and to try
to move `config/config.example.yml` to `config/config.yml`. If a user supplied
`config/config.yml` exists it is not overwritten.

* Update Dockerfile to use `shard.lock`

* Fix tests
											
										
										
											2020-12-10 07:18:30 +00:00
+								COPY --chown=invidious ./config/config.* ./config/
 								RUN mv -n config/config.example.yml config/config.yml
-												Verify download, fix invidious file permission (#949)

* Fix docker
											
										
										
											2020-05-01 01:35:34 +00:00
+								RUN sed -i 's/host: \(127.0.0.1\|localhost\)/host: postgres/' config/config.yml
-												Set correct permissions in Dockerfile

When having a `umask` of `xx7` (e.g. `027`) on the host machine then the directories `assets`, `config` and `locales` don't become readable to the `invidious` user inside the Docker container since the `COPY` commands result in files owned by `root` with the same file permissions like on the host (`640` in my case).

By adding `--chown=invidious` to the `COPY` command we ensure the `invidious` user can read these files.
											
										
										
											2021-05-05 08:16:11 +00:00
+								COPY --chown=invidious ./config/sql/ ./config/sql/
 								COPY --chown=invidious ./locales/ ./locales/
-												Proper fix for docker build

return to static linking
											
										
										
											2019-11-26 23:20:23 +00:00
+								COPY --from=builder /invidious/invidious .
-												Verify download, fix invidious file permission (#949)

* Fix docker
											
										
										
											2020-05-01 01:35:34 +00:00
-												add EXPOSE port command in Dockerfile (#1568)

added EXPOSE (see https://docs.docker.com/engine/reference/builder/#expose) in the Dockerfile. With this the reverse proxy Traefik can detect the port automatically.
											
										
										
											2020-12-13 18:49:54 +00:00
+								EXPOSE 3000
-												docker: various improvements to Dockerfile

This includes the following changes:

- Use multi-stage build to run application in an optimized environment, see
  https://docs.docker.com/develop/develop-images/multistage-build/
- Run application on alpine instead of archlinux to further reduce image size
- Build Crystal application with --release for improved runtime performance
- Run application as non-root user for better security, see
  https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
- Only rebuild Docker layers when required

											
										
										
											2019-08-01 10:49:12 +00:00
+								USER invidious
-												basic docker-compose cluster

											
										
										
											2018-09-26 07:46:08 +00:00
+								CMD [ "/invidious/invidious" ]