mirror of
https://gitee.com/wanwujie/sub2api
synced 2026-04-02 22:42:14 +08:00
aa5846b282
Docker named volumes and host bind-mounts may be owned by root, causing "open data/model_pricing.sha256: permission denied" when the container runs as the non-root sub2api user. Add an entrypoint script that fixes /app/data ownership before dropping to sub2api via su-exec. Replace USER directive with the entrypoint approach across all three Dockerfiles and update both GoReleaser configs to include the script in Docker build contexts.
63 lines
2.0 KiB
Docker
63 lines
2.0 KiB
Docker
# =============================================================================
|
|
# Sub2API Dockerfile for GoReleaser
|
|
# =============================================================================
|
|
# This Dockerfile is used by GoReleaser to build Docker images.
|
|
# It only packages the pre-built binary, no compilation needed.
|
|
# =============================================================================
|
|
|
|
ARG ALPINE_IMAGE=alpine:3.21
|
|
ARG POSTGRES_IMAGE=postgres:18-alpine
|
|
|
|
FROM ${POSTGRES_IMAGE} AS pg-client
|
|
|
|
FROM ${ALPINE_IMAGE}
|
|
|
|
LABEL maintainer="Wei-Shaw <github.com/Wei-Shaw>"
|
|
LABEL description="Sub2API - AI API Gateway Platform"
|
|
LABEL org.opencontainers.image.source="https://github.com/Wei-Shaw/sub2api"
|
|
|
|
# Install runtime dependencies
|
|
RUN apk add --no-cache \
|
|
ca-certificates \
|
|
tzdata \
|
|
curl \
|
|
su-exec \
|
|
libpq \
|
|
zstd-libs \
|
|
lz4-libs \
|
|
krb5-libs \
|
|
libldap \
|
|
libedit \
|
|
&& rm -rf /var/cache/apk/*
|
|
|
|
# Copy pg_dump and psql from a version-matched PostgreSQL image so backup and
|
|
# restore work in the runtime container without requiring Docker socket access.
|
|
COPY --from=pg-client /usr/local/bin/pg_dump /usr/local/bin/pg_dump
|
|
COPY --from=pg-client /usr/local/bin/psql /usr/local/bin/psql
|
|
COPY --from=pg-client /usr/local/lib/libpq.so.5* /usr/local/lib/
|
|
|
|
# Create non-root user
|
|
RUN addgroup -g 1000 sub2api && \
|
|
adduser -u 1000 -G sub2api -s /bin/sh -D sub2api
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy pre-built binary from GoReleaser
|
|
COPY sub2api /app/sub2api
|
|
|
|
# Create data directory
|
|
RUN mkdir -p /app/data && chown -R sub2api:sub2api /app
|
|
|
|
# Copy entrypoint script (fixes volume permissions then drops to sub2api)
|
|
COPY deploy/docker-entrypoint.sh /app/docker-entrypoint.sh
|
|
RUN chmod +x /app/docker-entrypoint.sh
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
|
CMD curl -f http://localhost:${SERVER_PORT:-8080}/health || exit 1
|
|
|
|
# Run the application (entrypoint fixes /app/data ownership then execs as sub2api)
|
|
ENTRYPOINT ["/app/docker-entrypoint.sh"]
|
|
CMD ["/app/sub2api"]
|