Dockerfile

# syntax=docker/dockerfile:1.7
FROM node:22-alpine AS frontend
WORKDIR /src/frontend
COPY frontend/package.json frontend/package-lock.json frontend/tsconfig.json frontend/eslint.config.mts ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY frontend/src ./src
RUN npm run build

FROM golang:1.26-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go mod download
COPY . .
COPY --from=frontend /src/internal/render/static/*.js ./internal/render/static/
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /redmemo ./cmd/redmemo


# Audio/video muxing is done in-process (internal/media: github.com/abema/go-mp4),
# so the runtime image no longer bundles a static ffmpeg binary.
FROM alpine:3.21
RUN --mount=type=cache,target=/var/cache/apk,sharing=locked \
    apk add ca-certificates tzdata \
    && addgroup -S redmemo && adduser -S redmemo -G redmemo
COPY --from=builder /redmemo /usr/local/bin/redmemo
RUN mkdir -p /data/media && chown -R redmemo:redmemo /data/media
USER redmemo
EXPOSE 8080
# No config baked in — matches Dockerfile.release. RedMemo runs on built-in
# defaults + REDMEMO_* env vars driven entirely by the compose file, so a
# build-from-source image boots from a single `docker compose up` with no
# config.yaml. Mount one only to pin YAML-only knobs (trusted_proxy_cidrs,
# hrlimit tuning, static OAuth tokens).
ENTRYPOINT ["redmemo"]