Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -199,7 +199,10 @@ jobs:
context: .
file: docker/Dockerfile.minimal
push: true
tags: ghcr.io/${{ github.repository }}:latest-minimal
# ghcr.io image names must be lowercase. github.repository preserves
# the org casing ("Beacon-Stack/prism"), which GHCR rejects, so we
# spell the repo out explicitly instead of using the expression.
tags: ghcr.io/beacon-stack/prism:latest-minimal
labels: ${{ steps.meta.outputs.labels }}
build-args: |
VERSION=${{ github.sha }}
Expand Down
18 changes: 9 additions & 9 deletions docker/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -33,12 +33,12 @@ COPY --from=frontend /app/web/static/ ./web/static/

# modernc/sqlite is pure Go — CGO_ENABLED=0 produces a fully static binary.
RUN CGO_ENABLED=0 GOOS=linux go build \
-ldflags "-X github.com/luminarr/luminarr/internal/version.Version=${VERSION} \
-X github.com/luminarr/luminarr/internal/version.BuildTime=${BUILD_TIME} \
-X github.com/luminarr/luminarr/internal/config.DefaultTMDBKey=${TMDB_API_KEY} \
-X github.com/luminarr/luminarr/internal/config.DefaultTraktClientID=${TRAKT_CLIENT_ID} \
-ldflags "-X github.com/prism/prism/internal/version.Version=${VERSION} \
-X github.com/prism/prism/internal/version.BuildTime=${BUILD_TIME} \
-X github.com/prism/prism/internal/config.DefaultTMDBKey=${TMDB_API_KEY} \
-X github.com/prism/prism/internal/config.DefaultTraktClientID=${TRAKT_CLIENT_ID} \
-s -w" \
-o /luminarr ./cmd/luminarr
-o /prism ./cmd/prism

# ── Final stage ───────────────────────────────────────────────────────────────
# Alpine with ffmpeg (includes ffprobe) for media scanning out of the box.
Expand All @@ -47,16 +47,16 @@ FROM alpine:3.21
# ffmpeg pulls in ffprobe. ca-certificates is needed for outbound HTTPS.
# tzdata provides timezone data for correct time display.
RUN apk add --no-cache ffmpeg ca-certificates tzdata postgresql-client && \
adduser -D -u 1000 luminarr
adduser -D -u 1000 prism

# The binary
COPY --from=builder /luminarr /luminarr
COPY --from=builder /prism /prism

# Default data directory (mount a volume here in production)
VOLUME ["/config"]

EXPOSE 8282

USER luminarr
USER prism

ENTRYPOINT ["/luminarr"]
ENTRYPOINT ["/prism"]
22 changes: 11 additions & 11 deletions docker/Dockerfile.minimal
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,17 @@ COPY . .

# modernc/sqlite is pure Go — CGO_ENABLED=0 produces a fully static binary.
RUN CGO_ENABLED=0 GOOS=linux go build \
-ldflags "-X github.com/luminarr/luminarr/internal/version.Version=${VERSION} \
-X github.com/luminarr/luminarr/internal/version.BuildTime=${BUILD_TIME} \
-X github.com/luminarr/luminarr/internal/config.DefaultTMDBKey=${TMDB_API_KEY} \
-X github.com/luminarr/luminarr/internal/config.DefaultTraktClientID=${TRAKT_CLIENT_ID} \
-ldflags "-X github.com/prism/prism/internal/version.Version=${VERSION} \
-X github.com/prism/prism/internal/version.BuildTime=${BUILD_TIME} \
-X github.com/prism/prism/internal/config.DefaultTMDBKey=${TMDB_API_KEY} \
-X github.com/prism/prism/internal/config.DefaultTraktClientID=${TRAKT_CLIENT_ID} \
-s -w" \
-o /luminarr ./cmd/luminarr
-o /prism ./cmd/prism

# Create a minimal /etc/passwd so the scratch image has a non-root user.
# UID/GID 65532 matches the distroless "nonroot" convention.
RUN echo "nonroot:x:65532:65532:nonroot:/:/sbin/nologin" > /etc/passwd.luminarr && \
echo "nonroot:x:65532:" > /etc/group.luminarr
RUN echo "nonroot:x:65532:65532:nonroot:/:/sbin/nologin" > /etc/passwd.prism && \
echo "nonroot:x:65532:" > /etc/group.prism

# ── Final stage ───────────────────────────────────────────────────────────────
# scratch: zero OS footprint. No ffprobe — media scanning requires host-side
Expand All @@ -37,11 +37,11 @@ FROM scratch
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

# Minimal passwd/group so the process can run as a named non-root user.
COPY --from=builder /etc/passwd.luminarr /etc/passwd
COPY --from=builder /etc/group.luminarr /etc/group
COPY --from=builder /etc/passwd.prism /etc/passwd
COPY --from=builder /etc/group.prism /etc/group

# The binary
COPY --from=builder /luminarr /luminarr
COPY --from=builder /prism /prism

# Default data directory (mount a volume here in production)
VOLUME ["/config"]
Expand All @@ -52,4 +52,4 @@ EXPOSE 8282
# or mounted with appropriate permissions, for the process to write to it.
USER nonroot:nonroot

ENTRYPOINT ["/luminarr"]
ENTRYPOINT ["/prism"]
Loading