Dockerfile

# MyAPI Hub on Hugging Face Spaces — single-container sidecar:
# postgres:18-alpine + redis + app + periodic pg_dump → /backup (HF bucket FUSE).
#
# PGDATA lives on Space ephemeral disk (FUSE is unsafe for live DB fsync).
# /backup is a mounted HF bucket; we dump there every BACKUP_INTERVAL_MIN minutes
# and restore on cold boot if PGDATA is empty and latest.sql.gz exists.

ARG APP_IMAGE=ghcr.io/jiayi-1994/sub2api:2.2.1

FROM ${APP_IMAGE} AS app

FROM postgres:18-alpine

USER root

# Renumber postgres user to uid/gid 1000 so HF bucket FUSE writes succeed under
# the same uid the container runs as.
RUN apk add --no-cache shadow redis supervisor tzdata ca-certificates bash \
    && groupmod -g 1000 postgres \
    && usermod -u 1000 -g 1000 postgres \
    && find / -xdev -uid 70 -exec chown 1000 {} + 2>/dev/null || true \
    && find / -xdev -gid 70 -exec chgrp 1000 {} + 2>/dev/null || true \
    && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
    && echo "Asia/Shanghai" > /etc/timezone

# Pull sub2api binary + entrypoint from upstream image.
COPY --from=app /app /app

# Anti-abuse rename of binary + pre-seed install lock so setup wizard is skipped
# (config comes from env via viper AutomaticEnv). Also scrub upstream binary
# name from any remaining references so /proc/*/cmdline never leaks it.
RUN cp /app/sub2api /app/svc \
    && chmod +x /app/svc \
    && rm -f /app/sub2api \
    && sed -i 's|/app/sub2api|/app/svc|g; s|sub2api|svc|g' /app/docker-entrypoint.sh \
    && mkdir -p /app/data \
    && printf 'installed_at=2026-01-01T00:00:00Z\n' > /app/data/.installed \
    && chmod 0400 /app/data/.installed \
    && printf '# managed by env vars (viper AutomaticEnv)\n' > /app/data/config.yaml

RUN mkdir -p /var/lib/postgresql/data /var/run/postgresql /var/log/supervisor /tmp/pg \
    && chown -R 1000:1000 /var/lib/postgresql /var/run/postgresql /var/log/supervisor /app /tmp/pg \
    && chmod 0700 /var/lib/postgresql/data

COPY entrypoint.sh /usr/local/bin/sidecar-entrypoint.sh
COPY backup.sh /usr/local/bin/backup.sh
COPY supervisord.conf /etc/supervisord.conf
RUN chmod +x /usr/local/bin/sidecar-entrypoint.sh /usr/local/bin/backup.sh \
    && chown 1000:1000 /etc/supervisord.conf

ENV PGDATA=/var/lib/postgresql/data \
    POSTGRES_USER=myapi \
    POSTGRES_DB=myapi \
    BACKUP_DIR=/backup \
    BACKUP_INTERVAL_MIN=30 \
    HOME=/var/lib/postgresql \
    SERVER_HOST=0.0.0.0 \
    SERVER_PORT=7860 \
    LOG_OUTPUT_TO_FILE=false \
    LOG_OUTPUT_TO_STDOUT=true \
    TZ=Asia/Shanghai \
    SERVER_MODE=release \
    RUN_MODE=standard \
    DATA_DIR=/app/data \
    DATABASE_HOST=127.0.0.1 \
    DATABASE_PORT=5432 \
    DATABASE_SSLMODE=disable \
    REDIS_HOST=127.0.0.1 \
    REDIS_PORT=6379 \
    REDIS_ENABLE_TLS=false

EXPOSE 7860

USER 1000
WORKDIR /app

ENTRYPOINT ["/usr/local/bin/sidecar-entrypoint.sh"]