From 43c7cb3ae5bf96ba8ad5f501d883c829cec7da80 Mon Sep 17 00:00:00 2001
From: Katos <7927609+katosdev@users.noreply.github.com>
Date: Sun, 30 Mar 2025 15:21:42 +0100
Subject: [PATCH] Create Dockerfile.rootless

Create rootless dockerfile
---
 Dockerfile.rootless | 60 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 Dockerfile.rootless

diff --git a/Dockerfile.rootless b/Dockerfile.rootless
new file mode 100644
index 00000000..2d4d08f7
--- /dev/null
+++ b/Dockerfile.rootless
@@ -0,0 +1,60 @@
+# Stage 1: Builder – compile the application
+FROM rust:1.82-alpine AS builder
+
+# Install build dependencies
+RUN apk add --no-cache musl-dev pkgconfig openssl-dev
+
+# Create a non-root user with UID 10001 (we use the same UID across stages)
+RUN adduser -D -u 10001 oxicloud
+
+WORKDIR /app
+
+# Copy dependency files first to leverage Docker cache for dependency compilation
+COPY Cargo.toml Cargo.lock ./
+
+# Prepare dummy source to build dependencies (improves caching)
+RUN mkdir -p src && \
+    echo "fn main() {}" > src/main.rs && \
+    touch src/lib.rs && \
+    cargo build --release && \
+    rm -rf src
+
+# Copy the actual source code and additional files
+COPY src ./src
+COPY db ./db
+
+# Build the actual application and strip debug symbols for a smaller binary
+RUN cargo build --release && \
+    strip target/release/oxicloud
+
+# Stage 2: Runtime – only include what is necessary to run the app
+FROM alpine:3.21.3
+
+# Install runtime dependencies and clean up cache
+RUN apk add --no-cache libgcc openssl ca-certificates tzdata && \
+    rm -rf /var/cache/apk/*
+
+# Create a non-root user with the same UID (10001) for consistent file ownership
+RUN adduser -D -u 10001 oxicloud
+
+# Create application directories, assign proper permissions
+WORKDIR /app
+RUN mkdir -p /app/static /app/storage && \
+    chown -R oxicloud:oxicloud /app
+
+# Copy the built binary from the builder stage and additional runtime files
+COPY --from=builder /app/target/release/oxicloud /app/oxicloud
+COPY static ./static
+COPY db ./db
+
+# Ensure all files are owned by the non-root user
+RUN chown -R oxicloud:oxicloud /app
+
+# Set the non-root user for running the application
+USER oxicloud
+
+# Expose the port the application listens on (use ports above 1024 to avoid root requirement)
+EXPOSE 3000
+
+# Run the binary in release mode
+CMD ["./oxicloud", "--release"]