🐋 NZBHydra2-distroless

This repository contains the code to build a small and secure distroless docker image for NZBHydra2 running as an unprivileged user. The final images are built and hosted on the dockerhub and the documentation is hosted on gitlab pages

✔️ Features summary

• 🥑 distroless minimal image
• 🤏 As few Docker layers as possible
• 🛡️ only basic runtime dependencies
• 🛡️ Runs as unprivileged user with minimal permissions

🏁 How to Run

docker run

$ docker run  -v /your/config/path/:/config \
              -v /your/torrent/blackhole/path/:/blackhole \
              -v /etc/localtime:/etc/localtime:ro \
              -e PUID=1000 \
              -e PGID=1000 \
              -p 5076:5076 \
              guillaumedsde/nzbhydra2-distroless:latest

🧊 Read-only docker run

If you want your container to be even more secure, you can run it with a read-only filesystem:

$ docker run  -v /your/config/path/:/config \
              -v /your/torrent/blackhole/path/:/blackhole \
              -v /etc/localtime:/etc/localtime:ro \
              -e PUID=1000 \
              -e PGID=1000 \
              -e S6_READ_ONLY_ROOT=1 \
              -p 5076:5076 \
              --read-only \
              --tmpfs /var:rw,exec \
              --tmpfs /tmp \
              guillaumedsde/nzbhydra2-distroless:latest

docker-compose.yml

version: "3.3"
services:
  nzbhydra2-distroless:
    volumes:
      - "/your/config/path/:/config"
      - "/your/torrent/blackhole/path/:/blackhole"
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      - PUID=1000
      - PGID=1000
    ports:
      - "5076:5076"
    image: "guillaumedsde/nzbhydra2-distroless:latest"

🧊 Read-only docker-compose.yml

If you want your container to be even more secure, you can run it with a read-only filesystem:

version: "3.3"
services:
  jackett-distroless:
    volumes:
      - "/your/config/path/:/config"
      - "/your/torrent/blackhole/path/:/blackhole"
      - "/etc/localtime:/etc/localtime:ro"
    environment:
      - PUID=1000
      - PGID=1000
      - S6_READ_ONLY_ROOT=1
    ports:
      - "5076:5076"
    tmpfs:
      - "/var:rw,exec"
      - "/tmp:rw,exec"
    read_only: true
    image: "guillaumedsde/nzbhydra2-distroless:latest"

⚙️ Available tags

Each NZBHydra2 docker image is published in two versions:

• latest v3.14.1-s6-overlay distroless base image with the s6 overlay added
• latest-distroless v3.14.1-distroless plain distroless base image

🖥️ Supported platforms

Currently this container supports only one (but widely used) platform:

• linux/amd64

🙏 Credits

A couple of projects really helped me out while developing this container:

• 💽 NZBHydra2 the awesome software
• 🏁 s6-overlay A simple, relatively small yet powerful set of init script for managing processes (especially in docker containers)
• 🥑 Google's distroless base docker images
• 🐋 The Docker project (of course)