hush-toolbox/Dockerfile at main · runify-dev/hush-toolbox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# syntax=docker/dockerfile:1
# hush-toolbox — multi-arch developer toolbox image
# Layers: L0 base → L1 system libs → L2 ffmpeg → L3 Python/Node packages → L4 entrypoint

# ---------------------------------------------------------------------------
# L0: base runtime
# ---------------------------------------------------------------------------
FROM python:3.12-slim AS base

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

ARG TARGETARCH

# Install Node.js 20 via nodesource
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates curl gnupg \
    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------------------
# L1: system runtime libraries
# external binaries: git
# CV/media: libgl1, libglib2.0-0
# audio: libsndfile1
# PDF: poppler-utils, libcairo2, libpango, libgdk-pixbuf
# OCR: tesseract-ocr + chi-sim (optional, ~200MB)
# ---------------------------------------------------------------------------
RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        libgl1 libglib2.0-0 \
        libsndfile1 \
        poppler-utils \
        libcairo2 libpango-1.0-0 libgdk-pixbuf-2.0-0 \
        tesseract-ocr tesseract-ocr-chi-sim \
    && rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------------------
# L2: ffmpeg / ffprobe (static binaries, per architecture)
# ---------------------------------------------------------------------------
COPY bin/ffmpeg_linux_${TARGETARCH} /usr/local/bin/ffmpeg
COPY bin/ffprobe_linux_${TARGETARCH} /usr/local/bin/ffprobe
RUN chmod +x /usr/local/bin/ffmpeg /usr/local/bin/ffprobe

# ffmpeg GPLv3 license
COPY licenses/ffmpeg-GPLv3.txt /usr/share/licenses/ffmpeg-GPLv3.txt

# ---------------------------------------------------------------------------
# L3: Python & Node packages (most volatile, topmost for cache)
# ---------------------------------------------------------------------------
WORKDIR /build
COPY requirements.txt .
RUN --mount=type=cache,target=/cache/pip,id=pip-${TARGETARCH} \
    PIP_CACHE_DIR=/cache/pip \
    pip install --no-cache-dir -r requirements.txt

WORKDIR /tmp
COPY package.json ./package.json
RUN npm install -g "$(node -e " \
        const p = require('./package.json'); \
        console.log(Object.keys(p.dependencies || {}).join(' '))")" \
    && rm -f package.json

# ---------------------------------------------------------------------------
# L4: Entrypoint — CA trust setup at runtime
# ---------------------------------------------------------------------------
COPY scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

# ---------------------------------------------------------------------------
# Final: non-root user, runtime constraints
# ---------------------------------------------------------------------------
RUN groupadd -r runner && useradd -r -g runner -m runner

# Install gosu for entrypoint to drop privileges (not in Debian repos)
RUN GOSU_VERSION=1.17 \
    && ARCH="$(dpkg --print-architecture)" \
    && curl -fsSL "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${ARCH}" \
       -o /usr/local/bin/gosu \
    && chmod +x /usr/local/bin/gosu \
    && gosu nobody true

# Pip/npm caches go to mounted volumes
ENV PIP_CACHE_DIR=/cache/pip \
    NPM_CONFIG_CACHE=/cache/npm

# Entrypoint runs as root (for CA setup), then drops to runner via gosu
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["/bin/bash"]