Merge pull request #25 from katosdev/main

Dockerfile.rootless

@@ -0,0 +1,60 @@
+# Stage 1: Builder – compile the application
+FROM rust:1.82-alpine AS builder
+
+# Install build dependencies
+RUN apk add --no-cache musl-dev pkgconfig openssl-dev
+
+# Create a non-root user with UID 10001 (we use the same UID across stages)
+RUN adduser -D -u 10001 oxicloud
+
+WORKDIR /app
+
+# Copy dependency files first to leverage Docker cache for dependency compilation
+COPY Cargo.toml Cargo.lock ./
+
+# Prepare dummy source to build dependencies (improves caching)
+RUN mkdir -p src && \
+    echo "fn main() {}" > src/main.rs && \
+    touch src/lib.rs && \
+    cargo build --release && \
+    rm -rf src
+
+# Copy the actual source code and additional files
+COPY src ./src
+COPY db ./db
+
+# Build the actual application and strip debug symbols for a smaller binary
+RUN cargo build --release && \
+    strip target/release/oxicloud
+
+# Stage 2: Runtime – only include what is necessary to run the app
+FROM alpine:3.21.3
+
+# Install runtime dependencies and clean up cache
+RUN apk add --no-cache libgcc openssl ca-certificates tzdata && \
+    rm -rf /var/cache/apk/*
+
+# Create a non-root user with the same UID (10001) for consistent file ownership
+RUN adduser -D -u 10001 oxicloud
+
+# Create application directories, assign proper permissions
+WORKDIR /app
+RUN mkdir -p /app/static /app/storage && \
+    chown -R oxicloud:oxicloud /app
+
+# Copy the built binary from the builder stage and additional runtime files
+COPY --from=builder /app/target/release/oxicloud /app/oxicloud
+COPY static ./static
+COPY db ./db
+
+# Ensure all files are owned by the non-root user
+RUN chown -R oxicloud:oxicloud /app
+
+# Set the non-root user for running the application
+USER oxicloud
+
+# Expose the port the application listens on (use ports above 1024 to avoid root requirement)
+EXPOSE 3000
+
+# Run the binary in release mode
+CMD ["./oxicloud", "--release"]

rootless-compose.yml

@@ -0,0 +1,45 @@
+services:
+  postgres:
+    image: postgres:17.4-alpine
+    restart: always
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: oxicloud
+#    ports:
+#      - "5432:5432"
+    networks:
+      - oxicloud
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+      - ./db/schema.sql:/docker-entrypoint-initdb.d/10-schema.sql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+  
+  oxicloud:
+    image: oxicloud
+    restart: always
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "8086:8086"
+      - "8085:8085"
+    networks:
+      - oxicloud
+    depends_on:
+      - postgres
+    environment:
+      - "OXICLOUD_DB_CONNECTION_STRING=postgres://postgres:postgres@postgres/oxicloud"
+    # Ensure the container runs with the non-root user (UID:GID 10001:10001)
+    user: "10001:10001"
+
+networks:
+  oxicloud:
+    driver: bridge
+
+volumes:
+  pg_data: