Merge pull request 'Docker improvements' (#61) from perennial/PixivFE:docker into v2

Reviewed-on: https://codeberg.org/VnPower/PixivFE/pulls/61

.env.example

@@ -0,0 +1,12 @@
+# -- PixivFE configuration
+# Visit https://codeberg.org/VnPower/PixivFE/wiki/Environment-variables for more details
+
+# -- Required
+# PIXIVFE_TOKEN=changethis # Only set here if not using a secret
+PIXIVFE_PORT=8282
+PIXIVFE_IMAGEPROXY=pixiv.ducks.party
+
+# -- Optional
+# PIXIVFE_USERAGENT=
+# PIXIVFE_BASEURL=
+# PIXIVFE_ACCEPTLANGUAGE=

.gitignore

@@ -1,4 +1,7 @@
 /tmp
 dev.sh
 /pixivfe
-.sass-cache/
+.sass-cache/
+.env
+# exclude changes to pixivfe_token.txt
+docker/pixivfe_token.txt

Dockerfile

@@ -1,13 +1,37 @@
+# ------ Builder stage ------
 FROM docker.io/golang:1.21 as builder
 WORKDIR /app
+
 COPY go.* ./
 RUN go mod download
 COPY . ./
-RUN CGO_ENABLED=0 GOOS=linux go build -mod=readonly -v -o pixivfe
 
-FROM docker.io/alpine:3
-COPY --from=builder /app/pixivfe /pixivfe
-COPY --from=builder /app/views /views
+# Build the application binary with optimisations for a smaller, static binary
+RUN CGO_ENABLED=0 GOOS=linux go build -mod=readonly -v -ldflags="-s -w" -o pixivfe
+
+# ------ Final image ------
+FROM docker.io/alpine:3.14
+WORKDIR /app
+
+# Create a non-root user `pixivfe` for security purposes and set ownership
+RUN addgroup -g 1000 -S pixivfe && \
+    adduser -u 1000 -S pixivfe -G pixivfe && \
+    chown -R pixivfe:pixivfe /app
+
+# Copy the compiled application and other necessary files from the builder stage
+COPY --from=builder /app/pixivfe /app/pixivfe
+COPY --from=builder /app/views /app/views
+COPY ./docker/entrypoint.sh /entrypoint.sh
+# Include entrypoint script and ensure it's executable
+RUN chmod +x /entrypoint.sh && \
+    chown pixivfe:pixivfe /entrypoint.sh
+
+# Use the non-root user to run the application
+USER pixivfe
+
 EXPOSE 8282
 
-ENTRYPOINT ["/pixivfe"]
+ENTRYPOINT ["/entrypoint.sh"]
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=15s --start-interval=5s --retries=3 \
+ CMD wget --spider -q --tries=1 http://127.0.0.1:8282/about || exit 1

docker-compose.yml

@@ -4,8 +4,8 @@ services:
   pixivfe:
     container_name: pixivfe
     hostname: pixivfe
-    restart: always
-    user: 65534:65534
+    restart: unless-stopped
+    user: 1000:1000
     read_only: true
     security_opt:
       - no-new-privileges:true
@@ -15,9 +15,19 @@ services:
       context: .
       dockerfile: Dockerfile
     ports:
-      - "8282:8282"
-    environment:
-      # Visit https://codeberg.org/VnPower/PixivFE/wiki/Environment-variables for more details
-      - PIXIVFE_TOKEN=changethis
-      - PIXIVFE_PORT=8282
-      - PIXIVFE_IMAGEPROXY=pximg.cocomi.cf
+      - "8282:8282" # Specify `127.0.0.1:8282:8282` instead if using a reverse proxy
+    env_file: .env
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://127.0.0.1:8282/about"]
+      interval: 30s
+      timeout: 3s
+      start_period: 15s
+      retries: 3
+    secrets:
+      - pixivfe_token
+
+secrets:
+  pixivfe_token:
+    # Copy the contents of the `PHPSESSID` cookie into `pixivfe_token.txt`
+    # See https://codeberg.org/VnPower/pixivfe/wiki/How-to-get-the-cookie-%28PIXIVFE_TOKEN%29 for instructions
+    file: ./docker/pixivfe_token.txt

docker/entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Check if the secret file exists at /run/secrets/pixivfe_token
+if [ -f /run/secrets/pixivfe_token ]; then
+    export PIXIVFE_TOKEN=$(cat /run/secrets/pixivfe_token)
+    echo "Info: PIXIVFE_TOKEN loaded from secret."
+else
+    echo "Info: PIXIVFE_TOKEN not loaded from secret. Loading the environment variable normally."
+fi
+
+# Execute the main application
+exec /app/pixivfe "$@"

docker/pixivfe_token.txt

@@ -0,0 +1 @@
+changethis