feat!: run container as non-root on debian, use uv

.checkov.yaml

@@ -0,0 +1,2 @@
+---
+skip-check: CKV_DOCKER_2

.dockerignore

@@ -0,0 +1,3 @@
+*
+
+!entrypoint.sh

.github/workflows/build-and-push-docker.yml

@@ -1,9 +1,13 @@
+---
 name: Build and push Docker image to DockerHub
-on:
+
+on: # yamllint disable-line rule:truthy
   push:
     tags:
       - 'v*'
 
+permissions: read-all
+
 jobs:
   push-to-registries:
     name: Push Docker image to Docker Hub and GitHub Packages

.github/workflows/lint.yaml

@@ -0,0 +1,32 @@
+---
+name: Lint
+
+on: # yamllint disable-line rule:truthy
+  push: null
+  pull_request: null
+
+permissions: {}
+
+jobs:
+  build:
+    name: Lint
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: read
+      # To report GitHub Actions status checks
+      statuses: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Super-linter
+        uses: super-linter/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          FIX_MARKDOWN_PRETTIER: true
+          FIX_YAML_PRETTIER: true

Dockerfile

@@ -1,43 +1,65 @@
 # syntax=docker/dockerfile:1
 
-FROM ubuntu:22.04
+FROM docker.io/library/python:3.10-slim-bookworm
 
 LABEL \
     maintainer="Martin Bjeldbak Madsen <[email protected]>" \
     org.opencontainers.image.title="acestream-http-proxy" \
-    org.opencontainers.image.description="Stream AceStream sources on macOS and other systems without needing to install AceStream player" \
+    org.opencontainers.image.description="Stream AceStream sources without needing to install AceStream player" \
     org.opencontainers.image.authors="Martin Bjeldbak Madsen <[email protected]>" \
     org.opencontainers.image.url="https://github.com/martinbjeldbak/acestream-http-proxy" \
     org.opencontainers.image.vendor="https://martinbjeldbak.com"
 
-ENV ACESTREAM_VERSION="3.2.3_ubuntu_22.04_x86_64_py3.10"
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-# Install acestream dependencies
-RUN apt-get update \
-  && apt-get install --no-install-recommends -y \
-      python3.10 ca-certificates wget sudo \
-  && rm -rf /var/lib/apt/lists/* \
-  #
-  # Download acestream
-  && wget --progress=dot:giga "https://download.acestream.media/linux/acestream_${ACESTREAM_VERSION}.tar.gz" \
-  && mkdir acestream \
-  && tar zxf "acestream_${ACESTREAM_VERSION}.tar.gz" -C acestream \
-  && rm "acestream_${ACESTREAM_VERSION}.tar.gz" \
-  && mv acestream /opt/acestream \
-  && pushd /opt/acestream || exit \
-  && bash ./install_dependencies.sh \
-  && popd || exit
-
-ENV ALLOW_REMOTE_ACCESS="no"
-ENV HTTP_PORT=6878
-ENV EXTRA_FLAGS=''
-
-COPY run.sh /
-
-ENTRYPOINT ["/usr/bin/bash"]
-CMD ["/run.sh"]
+ENV DEBIAN_FRONTEND="noninteractive" \
+    CRYPTOGRAPHY_DONT_BUILD_RUST=1 \
+    PIP_BREAK_SYSTEM_PACKAGES=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_ROOT_USER_ACTION=ignore \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_NO_CACHE=true \
+    UV_SYSTEM_PYTHON=true \
+    PYTHON_EGG_CACHE=/.cache
+
+ENV VERSION="3.2.3_ubuntu_22.04_x86_64_py3.10" \
+    ALLOW_REMOTE_ACCESS="no" \
+    EXTRA_FLAGS=''
+
+USER root
+WORKDIR /app
+
+# hadolint ignore=DL4006,DL3008,DL3013
+RUN \
+    apt-get update \
+    && \
+    apt-get install --no-install-recommends --no-install-suggests -y \
+        bash \
+        ca-certificates \
+        catatonit \
+        curl \
+        nano \
+        libgirepository1.0-dev \
+    && groupadd --gid 1000 appuser \
+    && useradd --uid 1000 --gid 1000 -m appuser \
+    && mkdir -p /app \
+    && mkdir -p /.cache \
+    && curl -fsSL "https://download.acestream.media/linux/acestream_${VERSION}.tar.gz" \
+        | tar xzf - -C /app \
+    && pip install uv \
+    && uv pip install --requirement /app/requirements.txt \
+    && chown -R appuser:appuser /.cache /app && chmod -R 755 /app \
+    && pip uninstall --yes uv \
+    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
+    && apt-get autoremove -y \
+    && apt-get clean \
+    && rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/
+
+COPY . /
+
+USER appuser
+
+ENTRYPOINT ["/usr/bin/catatonit", "--", "/entrypoint.sh"]
 
 EXPOSE 6878/tcp
 

docker-compose.yml

@@ -7,4 +7,4 @@ services:
     environment:
       - ALLOW_REMOTE_ACCESS=no # change to "yes" to allow internet access
       # add any extra command line option mentioned in https://docs.acestream.net/developers/engine-command-line-options/
-      - EXTRA_FLAGS='' 
+      - EXTRA_FLAGS=''

entrypoint.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+#shellcheck disable=SC2086
+
+if [[ $ALLOW_REMOTE_ACCESS == "yes" ]]; then
+	EXTRA_FLAGS="$EXTRA_FLAGS --bind-all"
+fi
+
+exec \
+	/app/start-engine \
+	--client-console \
+	"$EXTRA_FLAGS" \
+	"$@"