mirror of
https://github.com/0xERR0R/blocky.git
synced 2026-10-12 02:01:13 +00:00
Dimitri Herzog
d55cd4f50d
The image runs as UID 100 on a `scratch` base, so no directory other than
/app existed. Docker only propagates ownership into a fresh named volume
when the image already has content at the mount path - with nothing there,
the volume is created root:root 0755 and UID 100 cannot write to it.
That made *every* writable mount fail, named volumes included:
- loading.downloads.cachePath logged
"cannot create temp cache file in /cache, serving without caching"
and served uncached (#2165)
- the CSV query log writer logged "can't create/open file ... permission
denied" and dropped entries - this affected the `queryLogs:/logs`
named volume in our own advanced docker-compose example
Copy an empty dir into the final stage twice with --chown=100:100 to seed
/app/cache and /logs. A fresh named volume mounted over either path now
inherits UID 100 ownership and is writable with no host-side setup.
Bind mounts keep the host directory's ownership and still need
`chown 100:100` or a matching `--user`; document that, along with the
UID 100 requirement, in installation.md and next to cachePath. Also add
uid=100,gid=100 to the CIFS example, which mounts root-owned by default.
Fixes #2165
83 lines
2.6 KiB
Docker
83 lines
2.6 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ----------- stage: build
|
|
# Pin the build stage to the native build platform and cross-compile to the
|
|
# target platform. The build is CGO-free and the final stage is `scratch`, so
|
|
# nothing ever runs in the target arch at build time - this avoids compiling the
|
|
# Go toolchain under slow QEMU emulation for the arm targets.
|
|
FROM --platform=$BUILDPLATFORM golang:alpine AS build
|
|
RUN apk add --no-cache make coreutils libcap
|
|
|
|
# Arguments needed for dependency download
|
|
ARG GOPROXY=""
|
|
ARG OPTS=""
|
|
|
|
# setup go environment
|
|
ENV GO_SKIP_GENERATE=1\
|
|
GO_BUILD_FLAGS="-tags static -v ${OPTS}" \
|
|
CGO_ENABLED=0 \
|
|
BIN_USER=100\
|
|
BIN_AUTOCAB=1 \
|
|
BIN_OUT_DIR="/bin" \
|
|
GOPROXY=$GOPROXY
|
|
|
|
# Copy dependency files first for better caching
|
|
COPY go.mod go.sum ./
|
|
|
|
# Download dependencies (cached layer unless go.mod/go.sum change)
|
|
RUN go mod download
|
|
|
|
# Copy source code after dependencies are cached
|
|
COPY . .
|
|
|
|
# Arguments needed for build step only
|
|
ARG VERSION
|
|
ARG BUILD_TIME
|
|
|
|
# Target platform args populated automatically by BuildKit; cross-compile to them
|
|
ARG TARGETOS
|
|
ARG TARGETARCH
|
|
ARG TARGETVARIANT
|
|
|
|
RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} make build
|
|
|
|
# Empty dir, copied into the final stage to seed writable mount points. Docker
|
|
# propagates the ownership of an existing image directory to a fresh named
|
|
# volume mounted over it, so pre-creating these makes `-v blocky_cache:/app/cache`
|
|
# writable by the unprivileged container user without any host-side setup.
|
|
RUN mkdir -p /seed-dir
|
|
|
|
# ----------- stage: final
|
|
FROM scratch
|
|
|
|
ARG VERSION
|
|
ARG BUILD_TIME
|
|
ARG DOC_PATH
|
|
|
|
LABEL org.opencontainers.image.title="blocky" \
|
|
org.opencontainers.image.vendor="0xERR0R" \
|
|
org.opencontainers.image.licenses="Apache-2.0" \
|
|
org.opencontainers.image.version="${VERSION}" \
|
|
org.opencontainers.image.created="${BUILD_TIME}" \
|
|
org.opencontainers.image.description="Fast and lightweight DNS proxy as ad-blocker for local network with many features" \
|
|
org.opencontainers.image.url="https://github.com/0xERR0R/blocky#readme" \
|
|
org.opencontainers.image.source="https://github.com/0xERR0R/blocky" \
|
|
org.opencontainers.image.documentation="https://0xerr0r.github.io/blocky/${DOC_PATH}/"
|
|
|
|
|
|
|
|
USER 100
|
|
WORKDIR /app
|
|
|
|
COPY --from=build /bin/blocky /app/blocky
|
|
|
|
# Writable mount points owned by the container user (see comment in build stage).
|
|
COPY --from=build --chown=100:100 /seed-dir /app/cache
|
|
COPY --from=build --chown=100:100 /seed-dir /logs
|
|
|
|
ENV BLOCKY_CONFIG_FILE=/app/config.yml
|
|
|
|
ENTRYPOINT ["/app/blocky"]
|
|
|
|
HEALTHCHECK --start-period=1m --timeout=3s CMD ["/app/blocky", "healthcheck"]
|