mirror of
https://github.com/Heretek-Games/drop.git
synced 2026-10-12 02:05:06 +00:00
John Smith
28795296df
Two fresh-install breakages surfaced in production: 1. launch.sh ran 'pnpm prisma migrate deploy', but the image pins COREPACK_ENABLE_NETWORK=0, so corepack could not fetch pnpm at runtime and migration silently failed. Fresh instances booted against an empty schema (P2021 on every model). Call the globally installed prisma CLI directly instead; verified against the deployed image that 'prisma migrate deploy' applies all 133 migrations from /app with prisma.config.ts detection. 2. The docker user block chowned /data and /library for the drop user, but not /cache, so a fresh volume on CHUNK_CACHE_DIR was unwritable by uid 10001 and torrential could not seed the chunk cache.
124 lines
4.2 KiB
Docker
124 lines
4.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Pinned to bookworm so the glibc here matches the torrential build stage
|
|
# and the libarchive runtime package is named `libarchive13` (trixie renames it to libarchive13t64).
|
|
FROM node:lts-bookworm-slim AS base
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
WORKDIR /app
|
|
|
|
## so corepack knows pnpm's version
|
|
COPY . .
|
|
## prevent prompt to download
|
|
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
|
|
## setup for offline
|
|
RUN corepack pack
|
|
## don't call out to network anymore
|
|
ENV COREPACK_ENABLE_NETWORK=0
|
|
|
|
### INSTALL DEPS ONCE
|
|
FROM base AS deps
|
|
RUN pnpm install --frozen-lockfile --ignore-scripts
|
|
|
|
### BUILD TORRENTIAL
|
|
# Bookworm-pinned to match the runtime image's glibc (a trixie build would not run on bookworm).
|
|
FROM rustlang/rust:nightly-bookworm-slim AS torrential-build
|
|
## libarchive-dev + pkg-config let libarchive3-sys link libarchive dynamically (glibc).
|
|
## protobuf-compiler is kept for parity (torrential's build.rs uses a vendored protoc).
|
|
# hadolint ignore=DL3008
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libarchive-dev \
|
|
pkg-config \
|
|
protobuf-compiler \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN cargo build --release --locked --manifest-path ./torrential/Cargo.toml
|
|
|
|
### BUILD APP
|
|
FROM base AS build-system
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NUXT_TELEMETRY_DISABLED=1
|
|
|
|
## add git so drop can determine its git ref at build
|
|
# hadolint ignore=DL3008
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
## copy deps and rest of project files
|
|
COPY . .
|
|
COPY --from=deps /app/node_modules ./node_modules
|
|
|
|
|
|
ARG BUILD_DROP_VERSION
|
|
ARG BUILD_GIT_REF
|
|
|
|
## build
|
|
RUN pnpm run --filter=drop postinstall && pnpm run --filter=drop build
|
|
|
|
|
|
# create run environment for Drop
|
|
FROM base AS run-system
|
|
|
|
ENV NODE_ENV=production
|
|
ENV NUXT_TELEMETRY_DISABLED=1
|
|
|
|
# The base stage's `COPY . .` puts the whole repo into the runtime WORKDIR (/app),
|
|
# but at runtime only the artifacts copied explicitly below are needed. Drop the
|
|
# inherited `torrential` source dir: the service resolves the binary by scanning
|
|
# the cwd for `torrential`, and a directory there is spawned as ./torrential and
|
|
# fails with EACCES. With it gone, resolution falls through to the `torrential`
|
|
# binary installed on PATH (/usr/bin/torrential) below.
|
|
#
|
|
# runtime deps:
|
|
# - libarchive13: torrential now links libarchive dynamically (glibc build)
|
|
# - p7zip-full: provides the 7z CLI
|
|
# - nginx: front-end proxy
|
|
# - openssl + ca-certificates: required by Prisma's query engine on Debian
|
|
# pnpm itself is provided by corepack (enabled in the base stage).
|
|
# Install prisma globally and initialise it to download all required files.
|
|
# hadolint ignore=DL3008
|
|
RUN rm -rf /app/torrential \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
libarchive13 \
|
|
nginx \
|
|
openssl \
|
|
p7zip-full \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& pnpm install [email protected] --global --ignore-scripts \
|
|
&& pnpm prisma init
|
|
|
|
COPY --from=build-system /app/server/prisma.config.ts ./
|
|
COPY --from=build-system /app/server/.output ./app
|
|
COPY --from=build-system /app/server/prisma ./prisma
|
|
COPY --from=build-system /app/server/build ./startup
|
|
COPY --from=build-system /app/server/build/nginx.conf /nginx.conf
|
|
COPY --from=torrential-build /build/torrential/target/release/torrential /usr/bin/
|
|
|
|
# Run as an unprivileged user. Drop (port 4000) and nginx (port 3000) both bind
|
|
# unprivileged ports. Operators using bind-mounted /data or /library must make
|
|
# the mount writable by uid 10001, or run the container with a matching --user.
|
|
# /cache gets the same treatment: torrential seeds the chunk cache there
|
|
# (CHUNK_CACHE_DIR) and a fresh named volume would otherwise be unwritable
|
|
# for uid 10001.
|
|
RUN groupadd --system --gid 10001 drop \
|
|
&& useradd --system --uid 10001 --gid drop --home-dir /app --shell /usr/sbin/nologin drop \
|
|
&& mkdir -p /pnpm /data /library /cache \
|
|
&& chown -R drop:drop /app /pnpm /data /library /cache
|
|
|
|
ENV HOME="/app"
|
|
# Numeric id so hadolint can verify it; matches the `drop` user created above.
|
|
USER 10001:10001
|
|
|
|
ENV LIBRARY="/library"
|
|
ENV DATA="/data"
|
|
ENV NGINX_CONFIG="/nginx.conf"
|
|
# Nuxt's port
|
|
ENV PORT=4000
|
|
|
|
CMD ["sh", "/app/startup/launch.sh"]
|