forge/Dockerfile.rootless at master · Quad4-Software/forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# Quad4 Forge rootless image — multi-stage, digest-pinned bases.
# docker buildx build -f Dockerfile.rootless --build-arg RELEASE_VERSION=dev -t quad4-forge:dev .

# syntax=docker/dockerfile:1.7

ARG XX_IMAGE=docker.io/tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3
ARG GOLANG_IMAGE=docker.io/library/golang:1.26-alpine3.23@sha256:33ce311e5eecedee48ec1b84419c1306e9fbd71009f0d5c3f2a6904b579c1ecc
ARG ALPINE_IMAGE=docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

FROM --platform=$BUILDPLATFORM ${XX_IMAGE} AS xx

FROM --platform=$BUILDPLATFORM ${GOLANG_IMAGE} AS build-env

ARG GOPROXY
ENV GOPROXY=${GOPROXY:-https://proxy.golang.org,direct}

ARG RELEASE_VERSION=dev
ARG TAGS="sqlite sqlite_unlock_notify"
ENV TAGS="bindata timetzdata $TAGS"
ARG CGO_EXTRA_CFLAGS
ENV GOTOOLCHAIN=auto

COPY --from=xx / /
ARG TARGETPLATFORM
RUN apk --no-cache add clang lld build-base git nodejs npm make
RUN xx-apk --no-cache add gcc musl-dev
ENV CGO_ENABLED=1
RUN xx-go --wrap
RUN cp /*-alpine-linux-musl*/lib/ld-musl-*.so.1 /lib || true

COPY . ${GOPATH}/src/forgejo.org
WORKDIR ${GOPATH}/src/forgejo.org

RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    --mount=type=cache,target=/root/.npm \
    make clean-no-bindata \
 && make frontend \
 && go build -trimpath -ldflags="-s -w -buildid=" contrib/environment-to-ini/environment-to-ini.go \
 && xx-verify environment-to-ini \
 && make FORGEJO_GENERATE_SKIP_HASH=true RELEASE_VERSION=$RELEASE_VERSION GOFLAGS="-trimpath" go-check generate-backend static-executable \
 && xx-verify gitea

COPY docker/rootless /tmp/local
RUN chmod 755 /tmp/local/usr/local/bin/docker-entrypoint.sh \
              /tmp/local/usr/local/bin/docker-setup.sh \
              /tmp/local/usr/local/bin/gitea \
              /go/src/forgejo.org/gitea \
              /go/src/forgejo.org/environment-to-ini \
 && chmod 644 /go/src/forgejo.org/contrib/autocompletion/bash_autocomplete

FROM ${ALPINE_IMAGE}

ARG RELEASE_VERSION=dev
ARG BUILD_DATE=unknown
ARG VCS_REF=unknown
ARG VCS_URL=https://github.com/Quad4-Software/forge
ARG ALPINE_IMAGE=docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
LABEL maintainer="Quad4 Software" \
      org.opencontainers.image.title="Quad4 Forge (rootless)" \
      org.opencontainers.image.description="Quad4 Forge is a self-hosted charcoal-dark software forge." \
      org.opencontainers.image.authors="Quad4 Software" \
      org.opencontainers.image.vendor="Quad4 Software" \
      org.opencontainers.image.licenses="GPL-3.0-or-later" \
      org.opencontainers.image.url="${VCS_URL}" \
      org.opencontainers.image.documentation="${VCS_URL}" \
      org.opencontainers.image.source="${VCS_URL}" \
      org.opencontainers.image.version="${RELEASE_VERSION}" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.ref.name="${RELEASE_VERSION}" \
      org.opencontainers.image.base.name="${ALPINE_IMAGE}"

EXPOSE 2222 3000

RUN apk --no-cache add \
      bash ca-certificates dumb-init gettext git curl gnupg openssh-client \
 && rm -rf /var/cache/apk/* \
 && addgroup -S -g 1000 git \
 && adduser -S -H -D -h /var/lib/gitea/git -s /bin/bash -u 1000 -G git git \
 && mkdir -p /var/lib/gitea /tmp/gitea \
 && chown -R git:git /var/lib/gitea /tmp/gitea

COPY --from=build-env /tmp/local /
RUN cd /usr/local/bin && ln -sf gitea forgejo
COPY --from=build-env --chown=root:root /go/src/forgejo.org/gitea /app/gitea/gitea
RUN ln -sf /app/gitea/gitea /app/gitea/forgejo-cli
COPY --from=build-env --chown=root:root /go/src/forgejo.org/environment-to-ini /usr/local/bin/environment-to-ini
COPY --from=build-env /go/src/forgejo.org/contrib/autocompletion/bash_autocomplete /etc/profile.d/gitea_bash_autocomplete.sh

USER 1000:1000
ENV GITEA_WORK_DIR=/var/lib/gitea \
    GITEA_CUSTOM=/var/lib/gitea/custom \
    GITEA_TEMP=/tmp/gitea \
    TMPDIR=/tmp/gitea \
    GITEA_APP_INI=/var/lib/gitea/custom/conf/app.ini \
    HOME=/var/lib/gitea/git

VOLUME ["/var/lib/gitea"]
WORKDIR /var/lib/gitea

HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
  CMD curl -fsS http://127.0.0.1:3000/api/healthz || exit 1

ENTRYPOINT ["/usr/bin/dumb-init", "--", "/usr/local/bin/docker-entrypoint.sh"]
CMD []