External/trawl
1
0
Fork 0
mirror of https://github.com/germondai/trawl.git synced 2026-08-17 12:11:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(docker): support non-root runtime

Browse Source
This commit is contained in:
germondai
2026-08-10 02:49:33 +02:00
parent ac79af388f
commit 4445e10202
4 changed files with 82 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/Dockerfile
+18
View File
@@ -42,6 +42,10 @@ RUN bun install --frozen-lockfile --production --omit=dev --linker=hoisted \
FROM oven/bun:1.3.14 AS camoufox
ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox
ARG UBO_VERSION=1.73.0
ARG UBO_AMO_FILE_ID=4940584
ARG UBO_SHA256=bccc51a773150af4af6e1fd62c7bfdeb7238b79ff2381b998fa9f2e38f64786a
RUN apt-get update && apt-get install -y --no-install-recommends \
curl unzip ca-certificates && rm -rf /var/lib/apt/lists/*
@@ -82,6 +86,19 @@ RUN curl -fsSL \
[ "$(stat -c%s /opt/camoufox/GeoLite2-City.mmdb)" -gt 10000000 ] || \
{ echo "GeoLite2-City.mmdb download too small / failed"; exit 1; }
# Bake uBlock Origin into Camoufox's expected addon directory. camoufox-js still
# performs its normal addon registration at startup, but no runtime download or
# extraction is needed (including when /opt/camoufox is read-only).
RUN curl -fsSL \
"https://addons.mozilla.org/firefox/downloads/file/${UBO_AMO_FILE_ID}/ublock_origin-${UBO_VERSION}.xpi" \
-o /tmp/ubo.xpi && \
echo "${UBO_SHA256} /tmp/ubo.xpi" | sha256sum --check --strict - && \
mkdir -p /opt/camoufox/addons/UBO && \
unzip -q /tmp/ubo.xpi -d /opt/camoufox/addons/UBO && \
test -f /opt/camoufox/addons/UBO/manifest.json && \
test "$(bun -e 'console.log(JSON.parse(await Bun.file("/opt/camoufox/addons/UBO/manifest.json").text()).version)')" = "${UBO_VERSION}" && \
rm /tmp/ubo.xpi
# ── Stage 3: lean runtime (only API-required files) ────────────────────────────
# debian:bookworm-slim replaces ubuntu:22.04 — same glibc family, ~50 MB smaller base.
# Camoufox/Firefox require glibc; Alpine's musl is incompatible.
@@ -130,6 +147,7 @@ COPY apps/api/ /app/apps/api/
COPY package.json /app/
ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox \
HOME=/tmp \
# Safe Bun runtime knobs — all tested runtime-neutral (no behavior change).
BUN_DISABLE_CJS=1 \
BUN_DEBUG=0 \
apps/api/Dockerfile.baseline
+18
View File
@@ -42,6 +42,10 @@ RUN bun install --frozen-lockfile --production --omit=dev --linker=hoisted \
FROM oven/bun:1.3.14 AS camoufox
ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox
ARG UBO_VERSION=1.73.0
ARG UBO_AMO_FILE_ID=4940584
ARG UBO_SHA256=bccc51a773150af4af6e1fd62c7bfdeb7238b79ff2381b998fa9f2e38f64786a
RUN apt-get update && apt-get install -y --no-install-recommends \
curl unzip ca-certificates && rm -rf /var/lib/apt/lists/*
@@ -82,6 +86,19 @@ RUN curl -fsSL \
[ "$(stat -c%s /opt/camoufox/GeoLite2-City.mmdb)" -gt 10000000 ] || \
{ echo "GeoLite2-City.mmdb download too small / failed"; exit 1; }
# Bake uBlock Origin into Camoufox's expected addon directory. camoufox-js still
# performs its normal addon registration at startup, but no runtime download or
# extraction is needed (including when /opt/camoufox is read-only).
RUN curl -fsSL \
"https://addons.mozilla.org/firefox/downloads/file/${UBO_AMO_FILE_ID}/ublock_origin-${UBO_VERSION}.xpi" \
-o /tmp/ubo.xpi && \
echo "${UBO_SHA256} /tmp/ubo.xpi" | sha256sum --check --strict - && \
mkdir -p /opt/camoufox/addons/UBO && \
unzip -q /tmp/ubo.xpi -d /opt/camoufox/addons/UBO && \
test -f /opt/camoufox/addons/UBO/manifest.json && \
test "$(bun -e 'console.log(JSON.parse(await Bun.file("/opt/camoufox/addons/UBO/manifest.json").text()).version)')" = "${UBO_VERSION}" && \
rm /tmp/ubo.xpi
# ── Stage 3: lean runtime (only API-required files) ────────────────────────────
# debian:bookworm-slim replaces ubuntu:22.04 — same glibc family, ~50 MB smaller base.
# Camoufox/Firefox require glibc; Alpine's musl is incompatible.
@@ -148,6 +165,7 @@ COPY apps/api/ /app/apps/api/
COPY package.json /app/
ENV CAMOUFOX_INSTALL_DIR=/opt/camoufox \
HOME=/tmp \
# Safe Bun runtime knobs — all tested runtime-neutral (no behavior change).
BUN_DISABLE_CJS=1 \
BUN_DEBUG=0 \