mirror of
https://github.com/TriliumNext/Trilium.git
synced 2026-10-12 02:09:59 +00:00
Elian DoranandClaude Opus 5.5
eb911bdf73
HEALTHCHECK switched to `node` with `gosu node` (Debian, legacy) or
`su-exec node` (Alpine) before running docker_healthcheck.sh. Docker
runs the probe as the container's user, and without root the switch
fails ("failed switching to \"node\": operation not permitted",
"su-exec: setgroups: Operation not permitted"), so a container started
with --user reported unhealthy while it was serving.
The switch dates from the node-based probe. The shell script only reads
healthcheck-url and runs curl, which works as root and as any UID, so
it now runs directly, as the rootless images already did. gosu and
su-exec had no other users, since start-docker.sh switches with su,
and are no longer installed.
check-docker-non-root.sh now passes on Debian and Alpine for UID 1000
on a fresh volume and UID 1234 on its own directory. Root runs, with
and without USER_UID=1001, stay healthy with document.db owned by the
requested IDs.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
36 lines
1.4 KiB
Docker
36 lines
1.4 KiB
Docker
# Since better-sqlite3 v13 the addon is N-API based and ships prebuilt binaries
|
|
# for every supported platform/arch inside the package itself, which the server
|
|
# build copies into ./dist. There is therefore no native compile step and no
|
|
# builder stage any more. The Linux prebuilds need glibc >= 2.34 (x64) and
|
|
# >= 2.38 (arm64), so the base image is trixie rather than bookworm (glibc 2.36).
|
|
# Platforms without a prebuild (32-bit ARM) are served by Dockerfile.legacy,
|
|
# which still compiles from source.
|
|
FROM node:24.21.0-trixie-slim
|
|
|
|
# Install only runtime dependencies
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
curl && \
|
|
rm -rf \
|
|
/var/lib/apt/lists/* \
|
|
/var/cache/apt/*
|
|
|
|
WORKDIR /usr/src/app
|
|
COPY ./dist /usr/src/app
|
|
COPY ./start-docker.sh /usr/src/app
|
|
|
|
# A new named volume takes its owner from the mount point, so a container started with --user
|
|
# can write to it. Other UIDs need to pass through /home/node to reach a volume of their own.
|
|
RUN mkdir -p /home/node/trilium-data && \
|
|
chown node:node /home/node/trilium-data && \
|
|
chmod 700 /home/node/trilium-data && \
|
|
chmod 711 /home/node
|
|
|
|
# The healthcheck reads the listening address the server records here.
|
|
ENV TRILIUM_DATA_DIR=/home/node/trilium-data
|
|
|
|
# Configure container
|
|
EXPOSE 8080
|
|
CMD [ "sh", "./start-docker.sh" ]
|
|
HEALTHCHECK --interval=60s --timeout=5s --start-period=30s CMD sh /usr/src/app/docker_healthcheck.sh
|