roguecord/Dockerfile at main · tall1on/roguecord · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
# syntax=docker/dockerfile:1
#
# RogueCord server image (server only).
# Builds the Node.js server including the mediasoup native worker and the
# emoji SVG assets that the server serves to clients.
#
# Build:
#   docker build -t roguecord-server .
# Run:
#   docker run --rm -p 1337:1337 -p 10000-10100:10000-10100/udp \
#     -e MEDIASOUP_ANNOUNCED_IP=<your-public-ip> \
#     -v /srv/roguecord/data:/app/server/data roguecord-server
#

ARG NODE_VERSION=24

# ----------------------------------------------------------------------------
# Stage 1: build dependencies (compiles the mediasoup native worker)
# ----------------------------------------------------------------------------
FROM node:${NODE_VERSION}-bookworm-slim AS builder

# mediasoup compiles a C++ worker -> needs a toolchain. Its postinstall also
# runs `python3 -m pip install ... invoke` and builds via meson/ninja, so we
# need pip and the meson/ninja build tools. PIP_BREAK_SYSTEM_PACKAGES lets pip
# install into the mediasoup worker dir on PEP-668 (externally-managed) systems.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        make \
        g++ \
        pkg-config \
        meson \
        ninja-build \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/*

ENV PIP_BREAK_SYSTEM_PACKAGES=1

WORKDIR /app

# Copy only the server manifest first to leverage layer caching for npm install.
COPY server/package.json server/package-lock.json ./server/

# Install server dependencies so the mediasoup C++ worker gets built/downloaded.
RUN cd server && npm ci

# ----------------------------------------------------------------------------
# Stage 2: runtime image
# ----------------------------------------------------------------------------
FROM node:${NODE_VERSION}-bookworm-slim AS runtime

# Minimal runtime deps; the mediasoup worker binary is copied from the builder.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        tini \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Install production dependencies in the runtime stage so native modules
# (e.g. sqlite3) are built/downloaded for this glibc/toolchain environment.
COPY server/package.json server/package-lock.json ./server/

# Skip mediasoup's worker build/fetch during npm install; we provide the worker
# binary compiled in the builder stage below.
ENV MEDIASOUP_WORKER_BIN=/app/server/mediasoup-worker

# sqlite3's upstream prebuilt binaries are linked against a newer glibc than
# Debian Bookworm provides, so force native modules to build from source in the
# runtime image. Build tools are installed and purged in the same layer to keep
# the final image small.
ENV npm_config_build_from_source=true
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        python3 \
        make \
        g++ \
    && cd server && npm ci --omit=dev \
    && npm cache clean --force \
    && apt-get purge -y --auto-remove python3 make g++ \
    && rm -rf /var/lib/apt/lists/* /root/.cache /tmp/*

# Copy the server source.
COPY server/ ./server/

# The server serves Twemoji SVG assets from <cwd>/client/public/svg
# (see server/src/index.ts). The process runs with cwd=/app/server, so the
# assets must live at /app/server/client/public/svg to resolve correctly.
COPY client/public/svg/ ./server/client/public/svg/

# Copy only the compiled mediasoup worker binary from the builder stage.
COPY --from=builder /app/server/node_modules/mediasoup/worker/out/Release/mediasoup-worker /app/server/mediasoup-worker
RUN chmod +x /app/server/mediasoup-worker

# The SQLite database and uploaded files live under server/data. Persist it.
RUN mkdir -p /app/server/data \
    && chown -R node:node /app

# Drop privileges.
USER node

# Defaults (overridable via env / compose). See server/.env.example.
ENV NODE_ENV=production \
    LISTEN_IP=0.0.0.0 \
    PORT=1337 \
    MEDIASOUP_LISTEN_IP=0.0.0.0 \
    MEDIASOUP_ANNOUNCED_IP=127.0.0.1

# HTTP/WS port.
EXPOSE 1337
# WebRTC (mediasoup) UDP/TCP port range used by createWebRtcTransport.
EXPOSE 10000-10100

# tini reaps zombies and forwards signals (mediasoup spawns worker processes).
ENTRYPOINT ["/usr/bin/tini", "--"]

WORKDIR /app/server
CMD ["npm", "start"]