danvics/telegram-files
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

⚒️ chore: Optimize docker container do not run with root users.

Browse source
This commit is contained in:
jarvis2f 2025-02-07 17:18:59 +08:00
parent 74367f7353
commit 9b35f8ad39
2 changed files with 17 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
Dockerfile
View file

@ -51,7 +51,8 @@ WORKDIR /app
ARG LIB_PATH=/app/tdlib
ENV JAVA_HOME=/jre \
PATH="/jre/bin:$PATH"
PATH="/jre/bin:$PATH" \
LANG=C.UTF-8
RUN npm install -g pm2 && \
apt-get update && \
@ -74,18 +75,21 @@ RUN npm install -g pm2 && \
exit 1; \
fi && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* ./libs.zip
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* ./libs.zip && \
touch /run/nginx.pid && \
chown -R 1000:1000 /app /etc/nginx /var/lib/nginx /var/log/nginx /run/nginx.pid
COPY --from=runtime-builder /custom-jre/jre /jre
COPY --from=api-builder /app/api.jar /app/api.jar
COPY --from=web-builder /web/public /app/web/public
COPY --from=web-builder /web/.next/standalone /app/web/
COPY --from=web-builder /web/.next/static /app/web/.next/static
COPY --from=runtime-builder --chown=1000:1000 /custom-jre/jre /jre
COPY --from=api-builder --chown=1000:1000 /app/api.jar /app/api.jar
COPY --from=web-builder --chown=1000:1000 /web/public /app/web/public
COPY --from=web-builder --chown=1000:1000 /web/.next/standalone /app/web/
COPY --from=web-builder --chown=1000:1000 /web/.next/static /app/web/.next/static
COPY ./web/pm2.json /app/web/
COPY ./entrypoint.sh .
COPY ./nginx.conf /etc/nginx/nginx.conf
COPY --chown=1000:1000 ./web/pm2.json /app/web/
COPY --chown=1000:1000 ./entrypoint.sh .
COPY --chown=1000:1000 ./nginx.conf /etc/nginx/nginx.conf
USER 1000
EXPOSE 80
ENTRYPOINT ["/usr/bin/tini", "--"]

4
docker-compose.yaml
View file

@ -3,12 +3,14 @@ services:
container_name: telegram-files
image: ghcr.io/jarvis2f/telegram-files:latest
restart: always
# Default use 1000:1000 for user:group. If you want to use root, uncomment the line below.
# user: "root"
healthcheck:
test: [ "CMD", "curl", "-f", "http://127.0.0.1/api/health" ]
interval: 30s
retries: 3
timeout: 10s
start_period: 30s
start_period: 10s
environment:
APP_ENV: "prod"
APP_ROOT: "/app/data"