tajniak81andClaude Opus 4.8
e11acb8165
PocketBase renamed its release checksums asset from pocketbase_<version>_checksums.txt to checksums.txt. The old URL now returns 404, which fails BuildKit's ADD cache-key request with "failed to load cache key: invalid response status 404". Point the ADD in both Dockerfiles at the new checksums.txt name. The file's contents still list entries by full zip filename, so the sha256sum verification is unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
57 lines
2.1 KiB
Docker
57 lines
2.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---- build stage: fetch + verify + unzip PocketBase ----
|
|
FROM alpine:3.22 AS build
|
|
|
|
ARG PB_VERSION=0.39.7
|
|
# provided automatically by buildx (e.g. amd64, arm64)
|
|
ARG TARGETARCH
|
|
|
|
RUN apk add --no-cache unzip ca-certificates
|
|
|
|
# download the release zip and its checksums file
|
|
ADD https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip /tmp/pb.zip
|
|
ADD https://github.com/pocketbase/pocketbase/releases/download/v${PB_VERSION}/checksums.txt /tmp/pb_checksums.txt
|
|
|
|
# verify integrity against the published checksums, then unzip
|
|
RUN grep "pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip" /tmp/pb_checksums.txt \
|
|
| sed "s#pocketbase_${PB_VERSION}_linux_${TARGETARCH}.zip#/tmp/pb.zip#" \
|
|
| sha256sum -c - \
|
|
&& unzip /tmp/pb.zip -d /pb/
|
|
|
|
# ---- runtime stage: minimal image with just the binary ----
|
|
FROM alpine:3.22
|
|
|
|
# ca-certificates: outbound TLS (e.g. OAuth, mailer)
|
|
# sqlite: used by the entrypoint to check whether the superuser already exists
|
|
RUN apk add --no-cache ca-certificates sqlite \
|
|
# non-root user to run PocketBase
|
|
&& addgroup -S pb && adduser -S -G pb -H -D pb \
|
|
&& mkdir -p /pb/pb_data \
|
|
&& chown -R pb:pb /pb
|
|
|
|
COPY --from=build --chown=pb:pb /pb/pocketbase /pb/pocketbase
|
|
COPY --chown=pb:pb --chmod=0755 entrypoint.rootless.sh /pb/entrypoint.rootless.sh
|
|
|
|
# uncomment to copy the local pb_migrations dir into the image
|
|
# COPY --chown=pb:pb ./pb_migrations /pb/pb_migrations
|
|
|
|
# uncomment to copy the local pb_hooks dir into the image
|
|
# COPY --chown=pb:pb ./pb_hooks /pb/pb_hooks
|
|
|
|
# persist the SQLite database and uploaded files across container recreations
|
|
VOLUME /pb/pb_data
|
|
|
|
USER pb
|
|
|
|
# default listen port; override at runtime with -e PB_PORT=...
|
|
ENV PB_PORT=8080
|
|
EXPOSE 8080
|
|
|
|
# shell form so ${PB_PORT} is expanded from the runtime environment
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
|
|
CMD wget -qO- "http://127.0.0.1:${PB_PORT}/api/health" || exit 1
|
|
|
|
# entrypoint handles superuser bootstrap + encryption, then execs `serve`
|
|
ENTRYPOINT ["/pb/entrypoint.rootless.sh"]
|