Rootless Docker/Optimized build (#932)

* Rootless Dockerfile/Optimized build

Add unneeded files to .dockerignore
Split Dockerfile into more stages to allow Composer/Yarn to run concurrently
Don't log supervisord to a file, as file logging in a Docker container makes no sense
Redirect process output to container output for log processors
Run all processes as non-root
Minimize files with write permission for non-root user
Move docker folder out of .github, as it has nothing to do with GitHub

* Remove install-php-extensions utility after use and name final stage

* Test arm64 runner

* Allow Docker workflow caching multi-arch separately

* Fix Docker publish workflow branches

* Move Caddyfile/crontab config into docker directory, remove redundant supervisord user

* Further restrict permissions

* Supervisord logs

Dockerfile

@@ -1,69 +1,103 @@
+# syntax=docker.io/docker/dockerfile:1.7-labs
 # Pelican Production Dockerfile
 
 # ================================
-# Stage 1: Build PHP Dependencies
+# Stage 1: Build PHP Base Image
 # ================================
-FROM --platform=$TARGETOS/$TARGETARCH php:8.3-fpm-alpine AS composer
+FROM --platform=$TARGETOS/$TARGETARCH php:8.3-fpm-alpine AS base
+
+ADD --chmod=0755 https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions /usr/local/bin/
+
+RUN install-php-extensions bcmath gd intl zip opcache pcntl posix pdo_mysql
+
+RUN rm /usr/local/bin/install-php-extensions
+
+# ================================
+# Stage 2-1: Composer Install
+# ================================
+FROM --platform=$TARGETOS/$TARGETARCH base AS composer
 
 WORKDIR /build
 
-COPY . ./
 COPY --from=composer:latest /usr/bin/composer /usr/local/bin/composer
 
-# Install required libraries and PHP extensions
-RUN apk update && apk add --no-cache \
-    libpng-dev libjpeg-turbo-dev freetype-dev libzip-dev icu-dev \
-    zip unzip curl \
-    && docker-php-ext-install bcmath gd intl zip opcache pcntl posix pdo_mysql
+# Copy bare minimum to install Composer dependencies
+COPY composer.json composer.lock ./
 
-RUN composer install --no-dev --optimize-autoloader
+RUN composer install --no-dev --no-interaction --no-autoloader --no-scripts
 
 # ================================
-# Stage 2: Build Frontend Assets
+# Stage 2-2: Yarn Install
 # ================================
 FROM --platform=$TARGETOS/$TARGETARCH node:20-alpine AS yarn
 
 WORKDIR /build
 
-COPY --from=composer /build .
+# Copy bare minimum to install Yarn dependencies
+COPY package.json yarn.lock ./
 
 RUN yarn config set network-timeout 300000 \
-    && yarn install --frozen-lockfile \
-    && yarn run build
+    && yarn install --frozen-lockfile
 
 # ================================
-# Stage 3: Build Final Application Image
+# Stage 3-1: Composer Optimize
 # ================================
-FROM --platform=$TARGETOS/$TARGETARCH php:8.3-fpm-alpine
+FROM --platform=$TARGETOS/$TARGETARCH composer AS composerbuild
+
+# Copy full code to optimize autoload
+COPY --exclude=Caddyfile --exclude=docker/ . ./
+
+RUN composer dump-autoload --optimize
+
+# ================================
+# Stage 3-2: Build Frontend Assets
+# ================================
+FROM --platform=$TARGETOS/$TARGETARCH yarn AS yarnbuild
+
+WORKDIR /build
+
+# Copy full code
+COPY --exclude=Caddyfile --exclude=docker/ . ./
+COPY --from=composer /build .
+
+RUN yarn run build
+
+# ================================
+# Stage 4: Build Final Application Image
+# ================================
+FROM --platform=$TARGETOS/$TARGETARCH base AS final
 
 WORKDIR /var/www/html
 
-COPY --from=composer:latest /usr/bin/composer /usr/local/bin/composer
-
 # Install additional required libraries
 RUN apk update && apk add --no-cache \
-    libpng-dev libjpeg-turbo-dev freetype-dev libzip-dev icu-dev \
-    zip unzip curl caddy ca-certificates supervisor
+    caddy ca-certificates supervisor supercronic
 
-# Copy PHP extensions and configuration from Composer stage
-COPY --from=composer /usr/local/lib/php/extensions/ /usr/local/lib/php/extensions/
-COPY --from=composer /usr/local/etc/php/conf.d/ /usr/local/etc/php/conf.d/
+COPY --chown=root:www-data --chmod=640 --from=composerbuild /build .
+COPY --chown=root:www-data --chmod=640 --from=yarnbuild /build/public ./public
 
-COPY Caddyfile /etc/caddy/Caddyfile
-COPY --from=yarn /build .
-
-RUN touch .env
-
-# Set permissions for Laravel directories
-RUN chmod -R 755 storage bootstrap/cache \
-    && chown -R www-data:www-data ./
-
-# Add Laravel scheduler to crontab
-RUN echo "* * * * * php /var/www/html/artisan schedule:run >> /dev/null 2>&1" | crontab -u www-data -
+# Set permissions
+# First ensure all files are owned by root and restrict www-data to read access
+RUN chown root:www-data ./ \
+    && chmod 750 ./ \
+    # Files should not have execute set, but directories need it
+    && find ./ -type d -exec chmod 750 {} \; \
+    # Symlink to env/database path, as www-data won't be able to write to webroot
+    && ln -s /pelican-data/.env ./.env \
+    && ln -s /pelican-data/database/database.sqlite ./database/database.sqlite \
+    # Create necessary directories
+    && mkdir -p /pelican-data /var/run/supervisord /etc/supercronic \
+    # Finally allow www-data write permissions where necessary
+    && chown -R www-data:www-data /pelican-data ./storage ./bootstrap/cache /var/run/supervisord \
+    && chmod -R u+rwX,g+rwX,o-rwx /pelican-data ./storage ./bootstrap/cache /var/run/supervisord
 
 # Configure Supervisor
-RUN cp .github/docker/supervisord.conf /etc/supervisord.conf && \
-    mkdir /var/log/supervisord/
+COPY docker/supervisord.conf /etc/supervisord.conf
+COPY docker/Caddyfile /etc/caddy/Caddyfile
+# Add Laravel scheduler to crontab
+COPY docker/crontab /etc/supercronic/crontab
+
+COPY docker/entrypoint.sh ./docker/entrypoint.sh
 
 HEALTHCHECK --interval=5m --timeout=10s --start-period=5s --retries=3 \
   CMD curl -f http://localhost/up || exit 1
@@ -72,5 +106,7 @@ EXPOSE 80 443
 
 VOLUME /pelican-data
 
-ENTRYPOINT [ "/bin/ash", ".github/docker/entrypoint.sh" ]
+USER www-data
+
+ENTRYPOINT [ "/bin/ash", "docker/entrypoint.sh" ]
 CMD [ "supervisord", "-n", "-c", "/etc/supervisord.conf" ]