Skip to content
This repository was archived by the owner on Jun 14, 2026. It is now read-only.
Open
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 103 additions & 0 deletions Dockerfile.alpine
Original file line number Diff line number Diff line change
@@ -0,0 +1,103 @@
FROM python:3.12-alpine AS base

ENV PIP_VERSION=25.3
ENV REQUESTS_VERSION=2.32.5
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1

# Install system dependencies including mono
RUN apk add --no-cache \
ca-certificates \
curl \
ffmpeg \
gcompat \
icu-libs \
libgdiplus \
mediainfo \
mktorrent \
mono \
nano \
&& update-ca-certificates

# Setup venv
FROM base AS builder-venv

# Install build dependencies
RUN apk add --no-cache \
cargo \
gcc \
git \
g++ \
linux-headers \
musl-dev \
python3-dev

COPY requirements.txt /tmp/requirements.txt

# Python venv setup
RUN python -m venv /venv
ENV PATH="/venv/bin:$PATH"

# Install requirements
RUN pip install --no-cache-dir --upgrade pip==${PIP_VERSION} && \
pip install --no-cache-dir -r /tmp/requirements.txt

# Finalize app directory in seperate build stage
FROM base AS builder-app

# Copy virtual environment
COPY --from=builder-venv /venv /venv
ENV PATH="/venv/bin:$PATH"

# Install requests (for DVD MediaInfo download)
RUN pip install --upgrade requests==${REQUESTS_VERSION}

WORKDIR /Upload-Assistant

# Copy app into container
COPY . .

# Run DVD MediaInfo download script
RUN python3 bin/get_dvd_mediainfo_docker.py

# Download only the required mkbrr binary (requires full repo for src imports)
RUN python3 -c "from bin.get_mkbrr import MkbrrBinaryManager; MkbrrBinaryManager.download_mkbrr_for_docker()"

# Download bdinfo binary for the container architecture using the docker helper
RUN python3 bin/get_bdinfo_docker.py

RUN chown -R 1000:1000 /Upload-Assistant/bin/mkbrr \
&& chown -R 1000:1000 /Upload-Assistant/bin/MI \
&& chown -R 1000:1000 /Upload-Assistant/bin/bdinfo \
&& chmod -R +rx /Upload-Assistant/bin/mkbrr \
&& chmod -R +rx /Upload-Assistant/bin/MI \
&& chmod -R +rx /Upload-Assistant/bin/bdinfo

# Create tmp directory with appropriate permissions
RUN mkdir -p /Upload-Assistant/tmp && chmod 1777 /Upload-Assistant/tmp
ENV TMPDIR=/Upload-Assistant/tmp

# START BUILDING SLIM IMAGE
FROM base

# Copy venv
COPY --from=builder-venv /venv /venv
ENV PATH="/venv/bin:$PATH"

# Copy application
COPY --from=builder-app /Upload-Assistant /Upload-Assistant

WORKDIR /Upload-Assistant

EXPOSE 5000

STOPSIGNAL SIGTERM

# Health check for WebUI mode — ignored when running CLI
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD curl -sf http://localhost:5000/api/health || exit 1

ENTRYPOINT ["python", "/Upload-Assistant/upload.py"]
Comment on lines +80 to +100

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Run the container as a non‑root user.

The final image defaults to root; this is a common security risk and flagged by Trivy. Create a dedicated user and switch to it after setting ownership.

✅ Suggested fix
 # Create tmp directory with appropriate permissions
 RUN mkdir -p /Upload-Assistant/tmp && chmod 777 /Upload-Assistant/tmp
 ENV TMPDIR=/Upload-Assistant/tmp

+# Create non-root user and switch
+RUN addgroup -S app && adduser -S -G app -u 1000 app && \
+    chown -R app:app /Upload-Assistant /venv
+USER app
+
 # Set the entry point for the container
 ENTRYPOINT ["python", "/Upload-Assistant/upload.py"]
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.alpine` around lines 67 - 95, The image currently runs as root;
create a non-root user and drop privileges before the final ENTRYPOINT: add a
dedicated user/group (e.g., uid 1000 and a name like uploadassistant) after
copying files, chown the application directories to that user (update references
to /Upload-Assistant for bin/mkbrr, bin/MI and tmp ownership), then use USER
<username> (or USER 1000) before the ENTRYPOINT so the container runs
unprivileged; ensure TMPDIR and PATH remain accessible to that user and that any
files the app changes at runtime are owned or world-writable as needed.


# Default: show help when no arguments are provided
CMD ["-h"]