upbrr/Dockerfile at main · autobrr/upbrr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# syntax=docker/dockerfile:1

# GO_VERSION is the only global ARG: it is a custom arg interpolated into a FROM
# below. The predefined platform args (BUILDPLATFORM, TARGET*) are auto-available
# to FROM, and VERSION/BUILD_ID are declared inside the build stage where they are
# consumed (see below), so they do not need global declarations.
ARG GO_VERSION=1.26.5

FROM --platform=$BUILDPLATFORM node:24-alpine AS frontend

WORKDIR /src/webui

COPY webui/package.json webui/pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile

COPY webui/ ./
RUN pnpm run build:bundle

FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS cli-builder

WORKDIR /src

COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
        go mod download

COPY . .

# Embed the built web UI so `upbrr serve` can serve it. Mirrors
# scripts/sync-webui-assets.ps1 used by the binary release workflow.
COPY --from=frontend /src/webui/dist/ ./internal/webserver/assets/

ARG TARGETOS
ARG TARGETARCH
ARG TARGETVARIANT
ARG VERSION=dev
ARG BUILD_ID=

RUN --mount=type=cache,target=/root/.cache/go-build \
        set -eu; \
        goarm=""; \
        if [ "$TARGETARCH" = "arm" ] && [ -n "$TARGETVARIANT" ]; then \
            goarm="${TARGETVARIANT#v}"; \
        fi; \
        CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" GOARM="$goarm" \
            go build -trimpath -ldflags="-s -w -X main.version=${VERSION} -X main.buildIdentifier=${BUILD_ID}" -o /out/upbrr ./cmd/upbrr

FROM alpine:3.24

# fontconfig + a font are required by ffmpeg's drawtext filter (screenshot frame
# overlays); without them capture fails with "Cannot find a valid font for the
# family Sans". See issue #180.
RUN apk add --no-cache ca-certificates ffmpeg fontconfig font-dejavu mesa-vulkan-swrast vulkan-loader

# Run as a non-root user and give it a writable config dir. chown happens before
# VOLUME so anonymous/named volumes inherit the ownership.
RUN addgroup -g 1000 upbrr \
    && adduser -u 1000 -G upbrr -s /sbin/nologin -D -H upbrr \
    && mkdir -p /config \
    && chown upbrr:upbrr /config

COPY --from=cli-builder /out/upbrr /usr/local/bin/upbrr

# Persist config + database under /config (upbrr resolves XDG_CONFIG_HOME/upbrr).
ENV XDG_CONFIG_HOME=/config
# Probed by the HEALTHCHECK below via busybox wget (shipped in the alpine base, so no
# extra package). Uses loopback (works regardless of the serve bind host); override this
# env if you change the served --port or configure UPBRR_WEB_BASE_URL, e.g.
# http://127.0.0.1:7480/upbrr/api/auth/status.
ENV UPBRR_HEALTHCHECK_URL=http://127.0.0.1:7480/api/auth/status
VOLUME /config
EXPOSE 7480
USER upbrr

# busybox wget exits non-zero on connection failure or a non-2xx response.
HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
    CMD wget -q -O /dev/null "$UPBRR_HEALTHCHECK_URL"

ENTRYPOINT ["/usr/local/bin/upbrr"]
# Default to serving the web UI on all interfaces so published ports are reachable.
# Override the command (e.g. `docker run ... upbrr <cli args>`) for one-off CLI use.
CMD ["serve", "--host", "0.0.0.0"]