build(webui): migrate docker to lsio base

.changeset/kind-eggs-sin.md

@@ -0,0 +1,5 @@
+---
+"deemix-webui": minor
+---
+
+Docker image now correctly sets permissions and supports additional functionality due to being based on lsio/base

.github/workflows/build-publish-docker.yml

@@ -8,8 +8,10 @@ on:
     branches:
       - main
     paths:
-      - webui/CHANGELOG.md
       - .github/workflows/build-publish-docker.yml
+      - Dockerfile
+      - docker/**
+      - webui/CHANGELOG.md
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 

Dockerfile

@@ -3,6 +3,7 @@ FROM node:20-alpine AS base
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable && corepack install -g pnpm@latest-9
+
 WORKDIR /app
 
 COPY pnpm-lock.yaml .
@@ -27,32 +28,19 @@ COPY --from=builder /app/out/full/ .
 
 RUN pnpm turbo build --filter=deemix-webui...
 
-FROM base AS runner
-
-RUN apk add --no-cache su-exec
+FROM ghcr.io/linuxserver/baseimage-alpine:3.20 AS runner
 
-ENV NODE_ENV=production
-
-ENV DEEMIX_DATA_DIR=/config
-ENV DEEMIX_MUSIC_DIR=/downloads
-ENV DEEMIX_HOST=0.0.0.0
+RUN apk add --no-cache nodejs=~20
 
-COPY --from=installer /app .
+COPY --from=installer /app /app
 
-RUN mkdir -p \
-	$DEEMIX_DATA_DIR \
-	$DEEMIX_MUSIC_DIR
+COPY docker/ /
 
-# Create an entrypoint script
-RUN echo '#!/bin/sh' > /entrypoint.sh && \
-	echo 'chown -R nobody:users $DEEMIX_DATA_DIR $DEEMIX_MUSIC_DIR' >> /entrypoint.sh && \
-	echo 'chmod -R 775 $DEEMIX_DATA_DIR $DEEMIX_MUSIC_DIR' >> /entrypoint.sh && \
-	echo 'exec su-exec nobody:users "$@"' >> /entrypoint.sh && \
-	chmod +x /entrypoint.sh
-
-EXPOSE 6595
-
-WORKDIR /app/webui
+ENV DEEMIX_DATA_DIR=/config/
+ENV DEEMIX_MUSIC_DIR=/downloads/
+ENV DEEMIX_SERVER_PORT=6595
+ENV DEEMIX_HOST=0.0.0.0
+ENV NODE_ENV=production
 
-ENTRYPOINT ["/entrypoint.sh"]
-CMD ["node", "dist/main.js"]
+EXPOSE $DEEMIX_SERVER_PORT
+ENTRYPOINT [ "/init" ]

docker/etc/cont-init.d/10-fix_folders

@@ -0,0 +1,19 @@
+#!/usr/bin/with-contenv bash
+# shellcheck disable=SC1008
+
+printf '[cont-init.d] Fixing Folder Permissions - Config Folder\n'
+
+chown -R abc:abc /config
+
+if [ -n "${DISABLE_OWNERSHIP_CHECK}" ]; then
+	printf '[cont-init.d] Download Folder Ownership Check disabled by Environment Variable\n'
+else
+	printf '[cont-init.d] Fixing Folder Permissions - Downloads Folder\n'
+	find /downloads -type d -exec chown abc:abc {} +
+fi
+
+# Fix misconfigured download locations. The container's download map is always /downloads.
+if [ -f "/config/config.json" ]; then
+	jq '.downloadLocation = "/downloads"' /config/config.json >tmp.$$.json && mv tmp.$$.json /config/config.json
+	chown abc:abc /config/config.json
+fi

docker/etc/cont-init.d/15-checks

@@ -0,0 +1,23 @@
+#!/usr/bin/with-contenv bash
+# shellcheck disable=SC1008
+
+printf '[cont-init.d] Testing Access\n'
+
+if [ -w "/downloads" ]; then
+	printf '%-50s %2s %-5s \n' "[cont-init.d] Download Folder Write Access" ":" "Success"
+else
+	printf '%-50s %2s %-5s \n' "[cont-init.d] Download Folder Write Access" ":" "Failure"
+fi
+
+if [ -w "/config" ]; then
+	printf '%-50s %2s %-5s \n' "[cont-init.d] Config Folder Write Access" ":" "Success"
+else
+	printf '%-50s %2s %-5s \n' "[cont-init.d] Config Folder Write Access" ":" "Failure"
+fi
+
+until curl --fail -sf www.deezer.com; do
+	printf '%-50s %2s %-5s \n' "[cont-init.d] Internet Access" ":" "Failure. Trying again in 5 seconds"
+	sleep 5
+done
+
+printf '%-50s %2s %-5s \n' "[cont-init.d] Internet Access" ":" "Success"

docker/etc/services.d/deemix/run

@@ -0,0 +1,8 @@
+#!/usr/bin/with-contenv bash
+# shellcheck disable=SC1008
+
+UMASK_SET=${UMASK_SET:-022}
+umask "$UMASK_SET"
+
+echo "[services.d] Starting Deemix"
+s6-setuidgid abc node /app/webui/dist/main.js