Containerfile.linux

# reverse-proxy on Linux, built only by dbuild's shared GitHub workflow
# (build-linux job): the same Caddy with the same DNS modules, the same
# admin release, on Alpine with s6. Caddy runs as root to bind 80/443; the
# admin runs as bsd (PUID/PGID), as on FreeBSD. The admin is released from
# daemonless/reverse-proxy-src; keep RP_VERSION with Containerfile.j2's: the
# manifest adds this image to a tag only when the versions agree.
ARG RP_VERSION=
ARG CADDY_VERSION=

FROM golang:1.26-alpine AS caddy-build
ARG CADDY_VERSION
RUN apk add --no-cache git ca-certificates curl && \
    go install github.com/caddyserver/xcaddy/cmd/xcaddy@v0.4.7
RUN v="${CADDY_VERSION:-$(curl -fsSI https://github.com/caddyserver/caddy/releases/latest | grep -io 'releases/tag/v[^[:space:]]*' | head -1 | cut -d/ -f3)}" && \
    test -n "$v" && \
    CGO_ENABLED=0 GOFLAGS=-buildvcs=false xcaddy build "$v" \
      --with github.com/caddy-dns/cloudflare \
      --with github.com/caddy-dns/route53 \
      --with github.com/caddy-dns/desec \
      --with github.com/caddy-dns/porkbun \
      --with github.com/caddy-dns/hetzner \
      --with github.com/caddy-dns/ovh \
      --with github.com/caddy-dns/gandi \
      --with github.com/caddy-dns/rfc2136 \
      --with github.com/caddy-dns/acmedns \
      --with github.com/caddy-dns/duckdns@v0.5.0 \
      --output /out/caddy && \
    /out/caddy version

FROM alpine:3.24 AS admin-fetch
ARG RP_VERSION
RUN apk add --no-cache curl && \
    v="${RP_VERSION:-$(curl -fsSI https://github.com/daemonless/reverse-proxy-src/releases/latest | grep -io 'releases/tag/v[^[:space:]]*' | head -1 | cut -d/ -f3 | sed 's/^v//')}" && \
    test -n "$v" && \
    case "$(uname -m)" in x86_64) a=amd64 ;; aarch64) a=arm64 ;; *) echo "no admin build for $(uname -m)" >&2; exit 1 ;; esac && \
    f="reverse-proxy_${v}_linux_${a}.tar.gz" && \
    u="https://github.com/daemonless/reverse-proxy-src/releases/download/v${v}" && \
    mkdir -p /out && cd /out && \
    curl -fsSLO "$u/$f" -fsSLO "$u/SHA256SUMS" && \
    grep " $f\$" SHA256SUMS | sha256sum -c - && \
    tar -xzf "$f" --strip-components 1 && rm -f "$f" SHA256SUMS && \
    echo "$v" > /out/version && ./reverse-proxy dns-providers >/dev/null

FROM alpine:3.24
LABEL org.opencontainers.image.title="Daemonless Reverse Proxy" \
      org.opencontainers.image.description="Friendly HTTPS names for the services on your network: a managed Caddy reverse proxy with a web UI, secure by default." \
      org.opencontainers.image.source="https://github.com/daemonless/reverse-proxy" \
      org.opencontainers.image.url="https://daemonless.io/images/reverse-proxy/" \
      org.opencontainers.image.licenses="BSD-2-Clause" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Network" \
      io.daemonless.port="8443" \
      io.daemonless.volumes="/config,/data"
RUN apk add --no-cache s6 ca-certificates tzdata curl && \
    addgroup -g 1000 bsd && adduser -D -H -u 1000 -G bsd -s /sbin/nologin bsd && \
    mkdir -p /app /config /data
COPY --from=caddy-build /out/caddy /usr/local/bin/caddy
COPY --from=admin-fetch /out/reverse-proxy /usr/local/bin/reverse-proxy
COPY --from=admin-fetch /out/version /app/version
# Every DNS provider the UI offers is compiled into Caddy, and the reverse.
RUN reverse-proxy dns-providers | sort > /tmp/offered && \
    caddy list-modules | sed -n 's/^dns\.providers\.//p' | sort > /tmp/built && \
    diff -u /tmp/offered /tmp/built && rm -f /tmp/offered /tmp/built
COPY root/etc/reverse-proxy/bootstrap.json /etc/reverse-proxy/bootstrap.json
COPY root-linux/ /
RUN chmod +x /init /healthz /usr/local/bin/s6-ready-when /etc/cont-init.d/* /etc/services.d/*/run
EXPOSE 80 443 8443
VOLUME ["/config", "/data"]
HEALTHCHECK --interval=30s --timeout=10s CMD /healthz
ENTRYPOINT ["/init"]