Dockerfile

# =============================================================================
# Profilarr Dockerfile
# =============================================================================
# Multi-stage build for minimal final image size
#
# Build:  docker build -t profilarr .
# Run:    docker run -v ./config:/config -p 6868:6868 profilarr

# -----------------------------------------------------------------------------
# Stage 1: Build
# -----------------------------------------------------------------------------
ARG DENO_VERSION=2.8.3
FROM denoland/deno:${DENO_VERSION} AS builder

WORKDIR /build

# Copy dependency files first (cache key)
COPY deno.jsonc deno.lock* ./

# Copy everything else
COPY . .

# Install dependencies (needs full source to resolve npm: imports)
RUN deno ci

# Build the application
# 1. Vite builds SvelteKit to dist/build/
# 2. Deno compiles to standalone binary

# Build-time variables for version card
# TARGETARCH is automatically set by Docker buildx (amd64 or arm64)
ARG TARGETARCH
ARG VITE_CHANNEL=stable
ENV VITE_PLATFORM=docker-${TARGETARCH}
ENV VITE_CHANNEL=${VITE_CHANNEL}

# Build metadata stamped into src/lib/shared/build.ts so the version, channel,
# and commit are inlined into both server and client bundles at vite build time.
# Consumers import this file directly; no runtime config lookup.
ARG PROFILARR_VERSION=dev
ARG PROFILARR_COMMIT=unknown
ARG PROFILARR_BUILT_AT=unknown
RUN cat > src/lib/shared/build.ts <<EOF
// Generated by Dockerfile at image build time. Do not hand-edit.
export type Channel = 'stable' | 'develop' | 'dev';

export interface BuildInfo {
	readonly version: string;
	readonly channel: Channel;
	readonly commit: string | null;
	readonly builtAt: string | null;
}

export const build: BuildInfo = {
	version: '${PROFILARR_VERSION}',
	channel: '${VITE_CHANNEL}',
	commit: '${PROFILARR_COMMIT}',
	builtAt: '${PROFILARR_BUILT_AT}'
};
EOF

ENV APP_BASE_PATH=/build/dist/build
RUN deno run -A npm:vite build
RUN DENO_DIR=/tmp/profilarr-deno-cache \
    deno eval "import { hash } from '@felix/bcrypt'; await hash('profilarr')"
RUN DENO_TARGET=$(case "${TARGETARCH}" in \
        arm64) echo "aarch64-unknown-linux-gnu" ;; \
        *)     echo "x86_64-unknown-linux-gnu" ;; \
    esac) && \
    deno compile \
    --no-check \
    --allow-net \
    --allow-read \
    --allow-write \
    --allow-env \
    --allow-ffi \
    --allow-run \
    --allow-sys \
    --target "$DENO_TARGET" \
    --output dist/build/profilarr \
    dist/build/mod.ts

# -----------------------------------------------------------------------------
# Stage 2: Runtime
# -----------------------------------------------------------------------------
FROM denoland/deno:alpine-${DENO_VERSION}

# Labels for container metadata
LABEL org.opencontainers.image.title="Profilarr"
LABEL org.opencontainers.image.description="Configuration management for Radarr and Sonarr"
LABEL org.opencontainers.image.source="https://github.com/Dictionarry-Hub/profilarr"
LABEL org.opencontainers.image.licenses="AGPL-3.0"

# Install runtime dependencies
# - git: PCD repository operations (clone, pull, push)
# - tar: GNU tar for backup compatibility (not busybox tar)
# - curl: Health checks
# - su-exec: Drop privileges to non-root user (Alpine equivalent of gosu)
# - ca-certificates: HTTPS connections
# - sqlite-libs: SQLite shared library for FFI
# - bash: Entrypoint uses bash
# - shadow: Provides usermod/groupmod for PUID/PGID runtime changes
RUN apk add --no-cache \
    git \
    tar \
    curl \
    su-exec \
    ca-certificates \
    sqlite-libs \
    bash \
    shadow \
    && apk upgrade --no-cache

# Create application directory
WORKDIR /app

# Copy built application from builder stage
COPY --from=builder /build/dist/build/profilarr /app/profilarr
COPY --from=builder /build/dist/build/server.js /app/server.js
COPY --from=builder /build/dist/build/static /app/static
COPY --from=builder /tmp/profilarr-deno-cache/plug /app/deno-cache/plug

# Copy entrypoint script
COPY scripts/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Create a fixed profilarr user/group (UID/GID 1000).
# - Root/PUID mode: entrypoint may reassign UID/GID at runtime via usermod.
# - Non-root mode: set runAsUser: 1000 (K8s) or --user 1000 (Docker) to skip
#   all privilege operations and run directly as this user.
RUN deluser deno 2>/dev/null || true && \
    delgroup deno 2>/dev/null || true && \
    addgroup -g 1000 profilarr && \
    adduser -u 1000 -G profilarr -D -h /config -s /sbin/nologin profilarr

# Create config directory
RUN mkdir -p /config

# Environment variables
ENV PORT=6868
ENV HOST=0.0.0.0
ENV APP_BASE_PATH=/config
ENV TZ=UTC
ENV DENO_DIR=/app/deno-cache
ENV DENO_SQLITE_PATH=/usr/lib/libsqlite3.so.0
ENV LD_LIBRARY_PATH=/usr/local/lib/glibc

# Expose port
EXPOSE 6868

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
    CMD curl -sf http://localhost:${PORT}/api/v1/health || exit 1

# Volume for persistent data
VOLUME /config

# Entrypoint handles PUID/PGID/UMASK then runs the app
# Starts as root for chown/useradd, drops to PUID via su-exec before exec
# nosemgrep: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint
ENTRYPOINT ["/entrypoint.sh"]