mirror of
https://github.com/penpot/penpot.git
synced 2026-08-01 10:01:38 -04:00
97a833f1e7
Move Dockerfile.frontend, .backend, .exporter, .mcp and .storybook under docker/images/ from ubuntu:26.04 / nginx-unprivileged / a manual Node tarball install to Docker Hardened Images (Debian 13, or Alpine for storybook). storybook and mcp get a true non-dev runtime; frontend, backend and exporter keep the -dev tag as their final image, since each needs a shell and/or package manager at container runtime (nginx templating, fontforge/python3, and a headless-browser stack, respectively).
102 lines
2.5 KiB
Docker
102 lines
2.5 KiB
Docker
FROM dhi.io/node:24.18.1-debian13-dev
|
|
LABEL maintainer="Penpot <docker@penpot.app>"
|
|
|
|
ENV LANG=en_US.UTF-8 \
|
|
LC_ALL=en_US.UTF-8 \
|
|
DEBIAN_FRONTEND=noninteractive \
|
|
PATH=/opt/imagick/bin:$PATH \
|
|
PLAYWRIGHT_BROWSERS_PATH=/opt/penpot/browsers
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy --no-install-recommends install passwd; \
|
|
useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \
|
|
apt-get -qq dist-upgrade; \
|
|
apt-get -qqy --no-install-recommends install \
|
|
curl \
|
|
tzdata \
|
|
locales \
|
|
ca-certificates \
|
|
; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; \
|
|
locale-gen; \
|
|
find /usr/share/i18n/locales/ -type f ! -name "en_US" ! -name "POSIX" ! -name "C" -delete;
|
|
|
|
RUN set -ex; \
|
|
apt-get -qq update; \
|
|
apt-get -qqy install \
|
|
\
|
|
xvfb \
|
|
fonts-noto-color-emoji \
|
|
fonts-unifont \
|
|
libfontconfig1 \
|
|
libfreetype6 \
|
|
xfonts-cyrillic \
|
|
xfonts-scalable \
|
|
fonts-liberation \
|
|
fonts-ipafont-gothic \
|
|
fonts-wqy-zenhei \
|
|
fonts-tlwg-loma-otf \
|
|
fonts-freefont-ttf \
|
|
poppler-utils \
|
|
\
|
|
libasound2 \
|
|
libatk-bridge2.0-0 \
|
|
libatk1.0-0 \
|
|
libatspi2.0-0 \
|
|
libcairo2 \
|
|
libcups2 \
|
|
libdbus-1-3 \
|
|
libdrm2 \
|
|
libgbm1 \
|
|
libglib2.0-0 \
|
|
libnspr4 \
|
|
libnss3 \
|
|
libpango-1.0-0 \
|
|
libx11-6 \
|
|
libxcb1 \
|
|
libxcomposite1 \
|
|
libxdamage1 \
|
|
libxext6 \
|
|
libxfixes3 \
|
|
libxkbcommon0 \
|
|
libxrandr2 \
|
|
\
|
|
libgomp1 \
|
|
libheif1 \
|
|
libjpeg62-turbo \
|
|
liblcms2-2 \
|
|
libopenexr-3-1-30 \
|
|
libopenjp2-7 \
|
|
libpng16-16 \
|
|
librsvg2-2 \
|
|
libtiff6 \
|
|
libwebp7 \
|
|
libwebpdemux2 \
|
|
libwebpmux3 \
|
|
libxml2 \
|
|
libzip5 \
|
|
libzstd1 \
|
|
; \
|
|
apt-get clean; \
|
|
rm -rf /var/lib/apt/lists/*; \
|
|
mkdir -p /opt/penpot; \
|
|
chown -R penpot:penpot /opt/penpot;
|
|
|
|
ARG BUNDLE_PATH="./bundle-exporter/"
|
|
COPY --chown=penpot:penpot $BUNDLE_PATH /opt/penpot/exporter/
|
|
COPY --from=penpotapp/imagemagick:7.1.2-27 /opt/imagick /opt/imagick
|
|
|
|
WORKDIR /opt/penpot/exporter
|
|
|
|
# DHI Node image installs Node at the system level (symlinked into
|
|
# /usr/bin), so `./setup`'s internal `corepack enable` needs root to write
|
|
# there. Ownership is fixed right after.
|
|
RUN ./setup && chown -R penpot:penpot /opt/penpot/exporter
|
|
|
|
USER penpot:penpot
|
|
|
|
CMD ["node", "app.js"]
|