Skip to content
This repository was archived by the owner on Jun 24, 2025. It is now read-only.

Commit 0298c62

Browse files
perfectra1nperfectra1n
committed
feat(ci): add rootless dockerfiles
1 parent ae83f0a commit 0298c62

File tree

3 files changed

+162
-0
lines changed

3 files changed

+162
-0
lines changed

‎apps/server/Dockerfile.alpine.rootless

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
FROM node:22.15.0-alpine AS builder
2+
RUN corepack enable
3+
4+
# Install native dependencies since we might be building cross-platform.
5+
WORKDIR /usr/src/app
6+
COPY ./dist/package.json ./dist/pnpm-lock.yaml ./docker/pnpm-workspace.yaml /usr/src/app/
7+
# We have to use --no-frozen-lockfile due to CKEditor patches
8+
RUN pnpm install --no-frozen-lockfile --prod && pnpm rebuild
9+
10+
FROM node:22.15.0-alpine
11+
# Create a non-root user with configurable UID/GID
12+
ARG USER=trilium
13+
ARG UID=1001
14+
ARG GID=1001
15+
ENV USER=${USER}
16+
ENV UID=${UID}
17+
ENV GID=${GID}
18+
19+
# Install runtime dependencies and create user with specific UID/GID
20+
RUN apk add --no-cache dumb-init && \
21+
# Alpine uses addgroup/adduser (from busybox) instead of groupadd/useradd
22+
addgroup -g ${GID} ${USER} && \
23+
adduser -u ${UID} -G ${USER} -s /bin/sh -D -h /home/${USER} ${USER}
24+
25+
WORKDIR /home/${USER}/app
26+
COPY ./dist /home/${USER}/app
27+
RUN rm -rf /home/${USER}/app/node_modules/better-sqlite3
28+
COPY --from=builder /usr/src/app/node_modules/better-sqlite3 /home/${USER}/app/node_modules/better-sqlite3
29+
RUN chown -R ${USER}:${USER} /home/${USER}
30+
31+
# Configure container
32+
USER ${USER}
33+
EXPOSE 8080
34+
35+
# By default, use UID/GID that was set during build
36+
# These can be overridden at runtime
37+
ENV TRILIUM_UID=${UID}
38+
ENV TRILIUM_GID=${GID}
39+
ENV TRILIUM_DATA_DIR=/home/${USER}/trilium-data
40+
41+
# Use dumb-init as entrypoint to handle signals properly
42+
ENTRYPOINT ["/usr/bin/dumb-init", "--"]
43+
44+
# This script will handle UID/GID checks and start the app
45+
CMD [ "sh", "-c", "\
46+
if [ \"${TRILIUM_UID}\" != \"$(id -u)\" ] || [ \"${TRILIUM_GID}\" != \"$(id -g)\" ]; then \
47+
echo \"Detected UID:GID mismatch\"; \
48+
if [ \"${TRILIUM_GID}\" != \"$(id -g)\" ]; then \
49+
echo \"ERROR: Cannot change GID at runtime in rootless mode.\"; \
50+
echo \" Please use docker run with --user ${TRILIUM_UID}:${TRILIUM_GID} instead.\"; \
51+
exit 1; \
52+
fi; \
53+
if [ \"${TRILIUM_UID}\" != \"$(id -u)\" ]; then \
54+
echo \"ERROR: Cannot change UID at runtime in rootless mode.\"; \
55+
echo \" Please use docker run with --user ${TRILIUM_UID}:${TRILIUM_GID} instead.\"; \
56+
exit 1; \
57+
fi; \
58+
fi; \
59+
# Make sure data directory has correct permissions \
60+
mkdir -p \"${TRILIUM_DATA_DIR}\"; \
61+
# Start the app \
62+
exec node ./main \
63+
" ]
64+
65+
HEALTHCHECK --start-period=10s CMD node /home/${USER}/app/docker_healthcheck.js

‎apps/server/Dockerfile.rootless

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
FROM node:22.15.0-bullseye-slim AS builder
2+
RUN corepack enable
3+
4+
# Install native dependencies since we might be building cross-platform.
5+
WORKDIR /usr/src/app/build
6+
COPY ./dist/package.json ./dist/pnpm-lock.yaml ./docker/pnpm-workspace.yaml /usr/src/app/
7+
# We have to use --no-frozen-lockfile due to CKEditor patches
8+
RUN pnpm install --no-frozen-lockfile --prod && pnpm rebuild
9+
10+
FROM node:22.15.0-bullseye-slim
11+
# Create a non-root user with configurable UID/GID
12+
ARG USER=trilium
13+
ARG UID=1001
14+
ARG GID=1001
15+
ENV USER=${USER}
16+
ENV UID=${UID}
17+
ENV GID=${GID}
18+
19+
# Install only runtime dependencies
20+
RUN rm -rf \
21+
/var/lib/apt/lists/* \
22+
/var/cache/apt/* && \
23+
# Create the user/group with the default UID/GID
24+
groupadd -g ${GID} ${USER} && \
25+
useradd -u ${UID} -g ${USER} -s /bin/sh -m ${USER}
26+
27+
WORKDIR /home/${USER}/app
28+
COPY ./dist /home/${USER}/app
29+
RUN rm -rf /home/${USER}/app/node_modules/better-sqlite3
30+
COPY --from=builder /usr/src/app/node_modules/better-sqlite3 /home/${USER}/app/node_modules/better-sqlite3
31+
RUN chown -R ${USER}:${USER} /home/${USER}
32+
33+
# Configure container
34+
USER ${USER}
35+
EXPOSE 8080
36+
37+
# By default, use UID/GID that was set during build
38+
# These can be overridden at runtime
39+
ENV TRILIUM_UID=${UID}
40+
ENV TRILIUM_GID=${GID}
41+
ENV TRILIUM_DATA_DIR=/home/${USER}/trilium-data
42+
43+
# This script will handle UID/GID remapping if needed and then start the app
44+
CMD [ "sh", "-c", "\
45+
if [ \"${TRILIUM_UID}\" != \"$(id -u)\" ] || [ \"${TRILIUM_GID}\" != \"$(id -g)\" ]; then \
46+
echo \"Remapping user ${USER} to UID:GID ${TRILIUM_UID}:${TRILIUM_GID}\"; \
47+
# Use 'id -u' and 'id -g' to get current UID and GID \
48+
if [ \"${TRILIUM_GID}\" != \"$(id -g)\" ]; then \
49+
# Need root to modify user/group, but we can't use sudo, so we need to exit \
50+
echo \"ERROR: Cannot change GID at runtime in rootless mode.\"; \
51+
echo \" Please use docker run with --user ${TRILIUM_UID}:${TRILIUM_GID} instead.\"; \
52+
exit 1; \
53+
fi; \
54+
if [ \"${TRILIUM_UID}\" != \"$(id -u)\" ]; then \
55+
echo \"ERROR: Cannot change UID at runtime in rootless mode.\"; \
56+
echo \" Please use docker run with --user ${TRILIUM_UID}:${TRILIUM_GID} instead.\"; \
57+
exit 1; \
58+
fi; \
59+
fi; \
60+
# Make sure data directory has correct permissions \
61+
mkdir -p \"${TRILIUM_DATA_DIR}\"; \
62+
# Start the app \
63+
exec node ./main \
64+
" ]
65+
66+
HEALTHCHECK --start-period=10s CMD node /home/${USER}/app/docker_healthcheck.js

‎docker-compose.rootless.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
version: '3.8'
2+
3+
# Running `docker-compose -f docker-compose.rootless.yml up` will create/use the "trilium-data" directory in the user home
4+
# Run `TRILIUM_DATA_DIR=/path/of/your/choice docker-compose -f docker-compose.rootless.yml up` to set a different directory
5+
# To run in the background, use `docker-compose -f docker-compose.rootless.yml up -d`
6+
# To use the Alpine-based image, run with `TRILIUM_VARIANT=alpine docker-compose -f docker-compose.rootless.yml up`
7+
services:
8+
trilium:
9+
# Optionally, replace `latest` with a version tag like `v0.90.3`
10+
# Using `latest` may cause unintended updates to the container
11+
image: triliumnext/notes:rootless
12+
restart: unless-stopped
13+
environment:
14+
- TRILIUM_DATA_DIR=/home/trilium/trilium-data
15+
# Set the desired UID/GID for the Trilium process. Will be used during docker run
16+
# These should match the owner of your data directory on the host
17+
- TRILIUM_UID=${TRILIUM_UID:-1001}
18+
- TRILIUM_GID=${TRILIUM_GID:-1001}
19+
# Use the specified UID/GID for the container process
20+
user: ${TRILIUM_UID:-1001}:${TRILIUM_GID:-1001}
21+
ports:
22+
# By default, Trilium will be available at http://localhost:8080
23+
# It will also be accessible at http://<host-ip>:8080
24+
# You might want to limit this with something like Docker Networks, reverse proxies, or firewall rules
25+
- '8080:8080'
26+
volumes:
27+
# Unless TRILIUM_DATA_DIR is set, the data will be stored in the "trilium-data" directory in the home directory.
28+
# This can also be changed by replacing the line below with `- /path/of/your/choice:/home/trilium/trilium-data
29+
- ${TRILIUM_DATA_DIR:-~/trilium-data}:/home/trilium/trilium-data
30+
- /etc/timezone:/etc/timezone:ro
31+
- /etc/localtime:/etc/localtime:ro

0 commit comments

Comments
 (0)