danvics/pinchflat
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Updated dockerfile

Browse source
This commit is contained in:
Kieran Eglin 2024-04-02 09:22:41 -07:00
parent b57ff0edc3
commit b5d6db4ad2
No known key found for this signature in database
GPG key ID: 193984967FCF432D
1 changed files with 1 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
selfhosted.Dockerfile
View file

@ -95,11 +95,9 @@ ENV LANGUAGE en_US:en
ENV LC_ALL en_US.UTF-8 ENV LC_ALL en_US.UTF-8
WORKDIR "/app" WORKDIR "/app"
RUN chown nobody /app
# Set up data volumes # Set up data volumes
RUN mkdir /config /downloads RUN mkdir /config /downloads
RUN chown nobody /config /downloads
# set runner ENV # set runner ENV
ENV MIX_ENV="prod" ENV MIX_ENV="prod"
@ -108,20 +106,7 @@ ENV RUN_CONTEXT="selfhosted"
EXPOSE ${PORT} EXPOSE ${PORT}
# Only copy the final release from the build stage # Only copy the final release from the build stage
COPY --from=builder --chown=nobody:root /app/_build/${MIX_ENV}/rel/pinchflat ./ COPY --from=builder /app/_build/${MIX_ENV}/rel/pinchflat ./
# NEVER do this if you're running in an environment where you don't trust the user
# (ie: most environments). This is only acceptable in a self-hosted environment.
# The user could just run the whole container as root and bypass this anyway so
# it's not a huge deal.
# This removes the root password to allow users to assume root if needed. This is
# preferrable to running the whole container as root so that the files/directories
# created by the app aren't owned by root and are therefore easier for other users
# and processes to interact with. If you want to just run the whole container as
# root, use --user 0:0 or something.
RUN passwd -d root
USER nobody
# If using an environment that doesn't automatically reap zombie processes, it is # If using an environment that doesn't automatically reap zombie processes, it is
# advised to add an init process such as tini via `apt-get install` # advised to add an init process such as tini via `apt-get install`