ToolCTRLandClaude Opus 4.7
bec5dc7363
Deploy / build-and-deploy (push) Successful in 33s
Dockerfile installiert clamav-daemon + clamav-freshclam und konfiguriert clamd auf TCP 127.0.0.1:3310 mit DB-Verzeichnis auf der persistenten Coolify-Volume (/app/data/clamav-db). entrypoint.sh startet clamd und freshclam vor dem Node-Server, wartet auf clamd-PING und exec't dann node als unprivilegierter Nutzer. tini übernimmt PID 1 für Signal-Forwarding. Folge: GameJam-Uploads werden in Produktion automatisch per ClamAV geprüft, ohne dass Coolify manuell angepasst werden muss. Erster Deploy lädt einmalig ~300 MB Virendefinitionen auf die Volume, Folge-Starts in ~30 s. RAM-Bedarf des Containers ~1.5 GB. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
61 lines
2.4 KiB
Docker
61 lines
2.4 KiB
Docker
FROM node:22-bookworm-slim
|
||
|
||
LABEL org.opencontainers.image.description="ToolCTRL Website"
|
||
|
||
ARG APP_REVISION=local
|
||
|
||
ENV NODE_ENV=production \
|
||
PORT=3000 \
|
||
HOST=0.0.0.0 \
|
||
DATA_DIR=/app/data \
|
||
CLAMAV_HOST=127.0.0.1 \
|
||
CLAMAV_PORT=3310 \
|
||
CLAMAV_ENABLED=true \
|
||
APP_REVISION=${APP_REVISION}
|
||
|
||
# Debian-Postinst soll keine Daemons im Build starten.
|
||
RUN echo 'exit 101' > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d
|
||
|
||
RUN apt-get update \
|
||
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
|
||
ca-certificates curl tini gosu netcat-openbsd \
|
||
clamav clamav-daemon clamav-freshclam \
|
||
&& rm -rf /var/lib/apt/lists/* /var/lib/clamav/* \
|
||
&& rm -f /usr/sbin/policy-rc.d \
|
||
&& groupadd --gid 1001 nodejs \
|
||
&& useradd --uid 1001 --gid nodejs --home-dir /app --shell /usr/sbin/nologin nodejs
|
||
|
||
# clamd: TCP 127.0.0.1:3310, DB-Verzeichnis auf der persistenten Volume,
|
||
# Example-Zeile entfernen, damit clamd/freshclam überhaupt starten.
|
||
RUN sed -i 's/^Example/#Example/' /etc/clamav/clamd.conf /etc/clamav/freshclam.conf \
|
||
&& sed -i 's|^DatabaseDirectory .*|DatabaseDirectory /app/data/clamav-db|' \
|
||
/etc/clamav/clamd.conf /etc/clamav/freshclam.conf \
|
||
&& sed -i -e 's/^#\?TCPSocket .*/TCPSocket 3310/' \
|
||
-e 's/^#\?TCPAddr .*/TCPAddr 127.0.0.1/' \
|
||
/etc/clamav/clamd.conf \
|
||
&& (grep -q '^TCPSocket' /etc/clamav/clamd.conf || echo 'TCPSocket 3310' >> /etc/clamav/clamd.conf) \
|
||
&& (grep -q '^TCPAddr' /etc/clamav/clamd.conf || echo 'TCPAddr 127.0.0.1' >> /etc/clamav/clamd.conf) \
|
||
&& (grep -q '^DatabaseDirectory' /etc/clamav/clamd.conf || echo 'DatabaseDirectory /app/data/clamav-db' >> /etc/clamav/clamd.conf) \
|
||
&& (grep -q '^DatabaseDirectory' /etc/clamav/freshclam.conf || echo 'DatabaseDirectory /app/data/clamav-db' >> /etc/clamav/freshclam.conf)
|
||
|
||
WORKDIR /app
|
||
|
||
COPY --chown=nodejs:nodejs public ./public
|
||
COPY --chown=nodejs:nodejs server.js ./server.js
|
||
COPY entrypoint.sh /entrypoint.sh
|
||
RUN chmod +x /entrypoint.sh
|
||
|
||
RUN mkdir -p /app/data \
|
||
&& chown -R nodejs:nodejs /app/data
|
||
|
||
EXPOSE 3000
|
||
|
||
# Lange Start-Periode: erster Container-Start lädt die Virendefinitionen
|
||
# (~300 MB, ~1–2 Min). Danach liegen sie auf der persistenten Volume und
|
||
# Folge-Starts sind in ~30 s wieder oben.
|
||
HEALTHCHECK --interval=30s --timeout=3s --start-period=900s --retries=3 \
|
||
CMD curl -fsS http://127.0.0.1:3000/healthz >/dev/null || exit 1
|
||
|
||
ENTRYPOINT ["/usr/bin/tini", "--"]
|
||
CMD ["/entrypoint.sh"]
|