danvics/telegram-files
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

⚒️ chore: Optimize docker container do not run with root users.

Browse source
This commit is contained in:
jarvis2f 2025-02-07 17:18:59 +08:00
parent 74367f7353
commit 9b35f8ad39
2 changed files with 17 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
Dockerfile
View file

@ -51,7 +51,8 @@ WORKDIR /app
ARG LIB_PATH=/app/tdlib ARG LIB_PATH=/app/tdlib
ENV JAVA_HOME=/jre \ ENV JAVA_HOME=/jre \
PATH="/jre/bin:$PATH" PATH="/jre/bin:$PATH" \
LANG=C.UTF-8
RUN npm install -g pm2 && \ RUN npm install -g pm2 && \
apt-get update && \ apt-get update && \
@ -74,18 +75,21 @@ RUN npm install -g pm2 && \
exit 1; \ exit 1; \
fi && \ fi && \
apt-get clean && \ apt-get clean && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* ./libs.zip rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* ./libs.zip && \
touch /run/nginx.pid && \
chown -R 1000:1000 /app /etc/nginx /var/lib/nginx /var/log/nginx /run/nginx.pid
COPY --from=runtime-builder /custom-jre/jre /jre COPY --from=runtime-builder --chown=1000:1000 /custom-jre/jre /jre
COPY --from=api-builder /app/api.jar /app/api.jar COPY --from=api-builder --chown=1000:1000 /app/api.jar /app/api.jar
COPY --from=web-builder /web/public /app/web/public COPY --from=web-builder --chown=1000:1000 /web/public /app/web/public
COPY --from=web-builder /web/.next/standalone /app/web/ COPY --from=web-builder --chown=1000:1000 /web/.next/standalone /app/web/
COPY --from=web-builder /web/.next/static /app/web/.next/static COPY --from=web-builder --chown=1000:1000 /web/.next/static /app/web/.next/static
COPY ./web/pm2.json /app/web/ COPY --chown=1000:1000 ./web/pm2.json /app/web/
COPY ./entrypoint.sh . COPY --chown=1000:1000 ./entrypoint.sh .
COPY ./nginx.conf /etc/nginx/nginx.conf COPY --chown=1000:1000 ./nginx.conf /etc/nginx/nginx.conf
USER 1000
EXPOSE 80 EXPOSE 80
ENTRYPOINT ["/usr/bin/tini", "--"] ENTRYPOINT ["/usr/bin/tini", "--"]

4
docker-compose.yaml
View file

@ -3,12 +3,14 @@ services:
container_name: telegram-files container_name: telegram-files
image: ghcr.io/jarvis2f/telegram-files:latest image: ghcr.io/jarvis2f/telegram-files:latest
restart: always restart: always
# Default use 1000:1000 for user:group. If you want to use root, uncomment the line below.
# user: "root"
healthcheck: healthcheck:
test: [ "CMD", "curl", "-f", "http://127.0.0.1/api/health" ] test: [ "CMD", "curl", "-f", "http://127.0.0.1/api/health" ]
interval: 30s interval: 30s
retries: 3 retries: 3
timeout: 10s timeout: 10s
start_period: 30s start_period: 10s
environment: environment:
APP_ENV: "prod" APP_ENV: "prod"
APP_ROOT: "/app/data" APP_ROOT: "/app/data"