build: lightweight busybox-based container build (#5285)

.goreleaser.yml

@@ -40,17 +40,6 @@ archives:
       - goos: windows
         formats: ["zip"]
 
-upx:
-  - enabled: true
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - amd64
-      - arm64
-    compress: "best"
-    lzma: true
-
 dockers:
   # Alpine docker images
   - dockerfile: Dockerfile

Dockerfile

@@ -1,23 +1,37 @@
-FROM alpine:3.22
+## Multistage build: First stage fetches dependencies
+FROM alpine:3.22 AS fetcher
 
+# install and copy ca-certificates, mailcap, and tini-static; download JSON.sh
 RUN apk update && \
-  apk --no-cache add ca-certificates mailcap jq tini
+    apk --no-cache add ca-certificates mailcap tini-static && \
+    wget -O /JSON.sh https://raw.githubusercontent.com/dominictarr/JSON.sh/0d5e5c77365f63809bf6e77ef44a1f34b0e05840/JSON.sh
 
-# Make user and create necessary directories
+## Second stage: Use lightweight BusyBox image for final runtime environment
+FROM busybox:1.37.0-musl
+
+# Define non-root user UID and GID
 ENV UID=1000
 ENV GID=1000
 
+# Create user group and user
 RUN addgroup -g $GID user && \
-  adduser -D -u $UID -G user user && \
+    adduser -D -u $UID -G user user
-  mkdir -p /config /database /srv && \
-  chown -R user:user /config /database /srv
 
-# Copy files and set permissions
+# Copy binary, scripts, and configurations into image with proper ownership
-COPY filebrowser /bin/filebrowser
+COPY --chown=user:user filebrowser /bin/filebrowser
-COPY docker/common/ /
+COPY --chown=user:user docker/common/ /
-COPY docker/alpine/ /
+COPY --chown=user:user docker/alpine/ /
+COPY --chown=user:user --from=fetcher /sbin/tini-static /bin/tini
+COPY --from=fetcher /JSON.sh /JSON.sh
+COPY --from=fetcher /etc/ca-certificates.conf /etc/ca-certificates.conf
+COPY --from=fetcher /etc/ca-certificates /etc/ca-certificates
+COPY --from=fetcher /etc/mime.types /etc/mime.types
+COPY --from=fetcher /etc/ssl /etc/ssl
 
-RUN chown -R user:user /bin/filebrowser /defaults healthcheck.sh init.sh
+# Create data directories, set ownership, and ensure healthcheck script is executable
+RUN mkdir -p /config /database /srv && \
+    chown -R user:user /config /database /srv \
+    && chmod +x /healthcheck.sh
 
 # Define healthcheck script
 HEALTHCHECK --start-period=2s --interval=5s --timeout=3s CMD /healthcheck.sh

docker/alpine/healthcheck.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -e
+
+PORT=${FB_PORT:-$(cat /tmp/FB_CONFIG | sh /JSON.sh | grep '\["port"\]' | awk '{print $2}')}
+ADDRESS=${FB_ADDRESS:-$(cat /tmp/FB_CONFIG | sh /JSON.sh | grep '\["address"\]' | awk '{print $2}' | sed 's/"//g')}
+ADDRESS=${ADDRESS:-localhost}
+
+wget -q --spider http://$ADDRESS:$PORT/health || exit 1

docker/alpine/init.sh

@@ -7,19 +7,32 @@ if [ ! -f "/config/settings.json" ]; then
   cp -a /defaults/settings.json /config/settings.json
 fi
 
-# Deal with the case where user does not provide a config argument
+# Extract config file path from arguments
-has_config_arg=0
+config_file=""
+next_is_config=0
 for arg in "$@"; do
-  case "$arg" in
+  if [ "$next_is_config" -eq 1 ]; then
-  --config|--config=*|-c|-c=*)
+    config_file="$arg"
-    has_config_arg=1
     break
-    ;;
+  fi
+  case "$arg" in
+    -c|--config)
+      next_is_config=1
+      ;;
+    -c=*|--config=*)
+      config_file="${arg#*=}"
+      break
+      ;;
   esac
 done
 
-if [ "$has_config_arg" -eq 0 ]; then
+# If no config argument is provided, set the default and add it to the args                                                                 
-  set -- --config=/config/settings.json "$@"
+if [ -z "$config_file" ]; then 
-fi
+  config_file="/config/settings.json"                                                                                                                                                                                                 
+  set -- --config=/config/settings.json "$@"                                                                                                       
+fi                                                                                                                                                                                                                                                                                                                                                             
+
+# Create a symlink to the config file for compatibility with the healthcheck script
+ln -s "$config_file" /tmp/FB_CONFIG
 
 exec filebrowser "$@"