Add backend-only and SaaS-aware frontend Dockerfiles

2026-07-14 10:34:06 +02:00 · 2026-06-03 09:03:58 +01:00
parent 256d1a86d2
commit 58aeba2bf7
3 changed files with 178 additions and 3 deletions
@@ -20,6 +20,11 @@ tasks:
    cmds:
      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .

+  build:backend:
+    desc: "Build backend-only Docker image (no embedded frontend)"
+    cmds:
+      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
+
  build:frontend:
    desc: "Build frontend-only Docker image"
    cmds:
@@ -0,0 +1,134 @@
+# Stirling-PDF - Backend-only version (no embedded frontend)
+#
+# Identical to docker/embedded/Dockerfile except the JAR is built with
+# -PbuildWithFrontend=false, so the React UI is NOT baked in. The gradle build
+# then swaps in the lightweight API landing page (see app/core/build.gradle
+# copyApiLandingPage). Use this for the split frontend/backend deployments
+# (e.g. SaaS) where the UI ships as its own image (docker/frontend/Dockerfile).
+#
+# Because no frontend is built, the Node.js + go-task tooling that the embedded
+# image installs is intentionally omitted here — the only frontend gradle tasks
+# (npmInstall / npmBuild) are gated on buildWithFrontend and stay disabled.
+
+ARG BASE_VERSION=1.0.2
+ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
+
+# Stage 1: Build the Java application (backend only, no frontend)
+FROM gradle:9.3.1-jdk25@sha256:85aec999629f4774a383cb792da4b598bdf5a7e69c4b9570bb70c0f919179183 AS app-build
+
+# JDK 25+: --add-exports is no longer accepted via JAVA_TOOL_OPTIONS; use JDK_JAVA_OPTIONS instead
+ENV JDK_JAVA_OPTIONS="--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \
+  --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED \
+  --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED \
+  --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED \
+  --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED"
+
+WORKDIR /app
+
+COPY build.gradle settings.gradle gradlew ./
+COPY gradle/                               gradle/
+COPY app/core/build.gradle                  app/core/
+COPY app/common/build.gradle                app/common/
+COPY app/proprietary/build.gradle           app/proprietary/
+
+# Use system gradle instead of gradlew to avoid SSL issues downloading gradle distribution on emulated arm64
+RUN gradle dependencies --no-daemon || true
+
+COPY . .
+
+ARG PROTOTYPES_BUILD=false
+ARG STIRLING_FLAVOR=proprietary
+ENV STIRLING_FLAVOR=${STIRLING_FLAVOR}
+
+# buildWithFrontend=false → backend-only JAR with API landing page.
+RUN STIRLING_FLAVOR=${STIRLING_FLAVOR} \
+    gradle clean build \
+      -PbuildWithFrontend=false \
+      -PprototypesMode=${PROTOTYPES_BUILD} \
+      -x spotlessApply -x spotlessCheck -x test -x sonarqube \
+      --no-daemon
+
+# Stage 2: Extract Spring Boot Layers
+FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
+WORKDIR /tmp
+COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
+RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
+
+
+# Stage 3: Final runtime image on top of pre-built base
+FROM ${BASE_IMAGE}
+
+ARG VERSION_TAG
+
+WORKDIR /app
+
+# Application layers
+COPY --link --from=jar-extract --chown=1000:1000 /layers/dependencies/           /app/
+COPY --link --from=jar-extract --chown=1000:1000 /layers/spring-boot-loader/     /app/
+COPY --link --from=jar-extract --chown=1000:1000 /layers/snapshot-dependencies/  /app/
+COPY --link --from=jar-extract --chown=1000:1000 /layers/application/            /app/
+
+COPY --link --from=app-build --chown=1000:1000 \
+     /app/build/libs/restart-helper.jar /restart-helper.jar
+COPY --link --chown=1000:1000 scripts/ /scripts/
+
+# Fonts go to system dir, root ownership is correct (world-readable)
+COPY app/core/src/main/resources/static/fonts/*.ttf /usr/share/fonts/truetype/
+
+# Permissions and configuration
+RUN set -eux; \
+    chmod +x /scripts/*; \
+    ln -s /logs /app/logs; \
+    ln -s /configs /app/configs; \
+    ln -s /customFiles /app/customFiles; \
+    ln -s /pipeline /app/pipeline; \
+    ln -s /storage /app/storage; \
+    chown -h stirlingpdfuser:stirlingpdfgroup /app/logs /app/configs /app/customFiles /app/pipeline /app/storage; \
+    chown stirlingpdfuser:stirlingpdfgroup /app; \
+    chmod 750 /tmp/stirling-pdf; \
+    chmod 750 /tmp/stirling-pdf/heap_dumps; \
+    fc-cache -f
+
+# Write version to a file so it is readable by scripts without env-var inheritance.
+# init-without-ocr.sh reads /etc/stirling_version for the AOT cache fingerprint.
+RUN echo "${VERSION_TAG:-dev}" > /etc/stirling_version
+
+# Environment variables
+ENV VERSION_TAG=$VERSION_TAG \
+    STIRLING_AOT_ENABLE="false" \
+    STIRLING_JVM_PROFILE="balanced" \
+    _JVM_OPTS_BALANCED="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:G1HeapRegionSize=4m -XX:G1PeriodicGCInterval=60000 -XX:+UseStringDeduplication -XX:+UseCompactObjectHeaders -XX:+ExplicitGCInvokesConcurrent -Dspring.threads.virtual.enabled=true -Djava.awt.headless=true" \
+    _JVM_OPTS_PERFORMANCE="-XX:+ExitOnOutOfMemoryError -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/configs/heap_dumps -XX:+UseShenandoahGC -XX:ShenandoahGCMode=generational -XX:+UseCompactObjectHeaders -XX:+UseStringDeduplication -XX:+AlwaysPreTouch -XX:+ExplicitGCInvokesConcurrent -Dspring.threads.virtual.enabled=true -Djava.awt.headless=true" \
+    JAVA_CUSTOM_OPTS="" \
+    HOME=/home/stirlingpdfuser \
+    PUID=1000 \
+    PGID=1000 \
+    UMASK=022 \
+    STIRLING_TEMPFILES_DIRECTORY=/tmp/stirling-pdf \
+    TMPDIR=/tmp/stirling-pdf \
+    TEMP=/tmp/stirling-pdf \
+    TMP=/tmp/stirling-pdf \
+    DBUS_SESSION_BUS_ADDRESS=/dev/null \
+    SAL_TMP=/tmp/stirling-pdf/libre
+
+# Metadata labels
+LABEL org.opencontainers.image.title="Stirling-PDF Backend" \
+      org.opencontainers.image.description="Backend-only version (no embedded UI) with Calibre, LibreOffice, Tesseract, OCRmyPDF" \
+      org.opencontainers.image.source="https://github.com/Stirling-Tools/Stirling-PDF" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.vendor="Stirling-Tools" \
+      org.opencontainers.image.url="https://www.stirlingpdf.com" \
+      org.opencontainers.image.documentation="https://docs.stirlingpdf.com" \
+      maintainer="Stirling-Tools" \
+      org.opencontainers.image.authors="Stirling-Tools" \
+      org.opencontainers.image.version="${VERSION_TAG}" \
+      org.opencontainers.image.keywords="PDF, manipulation, backend, API, Spring Boot"
+
+EXPOSE 8080/tcp
+STOPSIGNAL SIGTERM
+
+HEALTHCHECK --interval=30s --timeout=15s --start-period=120s --retries=5 \
+  CMD curl -fs --max-time 10 http://localhost:8080${SYSTEM_ROOTURIPATH:-''}/api/v1/info/status || exit 1
+
+ENTRYPOINT ["tini", "--", "/scripts/init.sh"]
+CMD []
@@ -1,3 +1,8 @@
+# check=skip=SecretsUsedInArgOrEnv
+# The only ARG the SecretsUsedInArgOrEnv rule flags here is the Supabase
+# PUBLISHABLE key — a client-safe value embedded in the bundle by design, not a
+# secret. No real secrets are passed via ARG/ENV in this image.
+
 # Frontend Dockerfile - React/Vite application
 FROM node:25-alpine@sha256:e80397b81fa93888b5f855e8bef37d9b18d3c5eb38b8731fc23d6d878647340f AS build

@@ -12,8 +17,39 @@ RUN npm ci
 # Copy source code
 COPY frontend .

-# Build the application (vite root is editor/, output lands in editor/dist/)
-RUN npx vite build editor
+# Generate the material-symbols icon subset that LocalIcon.tsx imports at build
+# time. Normally produced by `task frontend:build:<mode>` via its prepare:icons
+# dependency; since this Dockerfile invokes vite directly, run it explicitly.
+# Fully offline — reads the @iconify-json/material-symbols dev dependency.
+RUN node editor/scripts/generate-icons.js
+
+# ---- Build configuration (backward compatible) ----
+# STIRLING_FLAVOR selects the editor tsconfig + source set (see
+# frontend/editor/vite.config.ts). VITE_BUILD_MODE selects which .env.<mode>
+# files vite loads and is passed to `vite build --mode`. The defaults below
+# reproduce the previous behaviour exactly: proprietary flavor, production mode
+# (vite's implicit default for `vite build`).
+#
+# VITE_SUPABASE_URL + VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY are CLIENT-SAFE
+# publishable values, NOT secrets. They are intentionally empty here so the OSS
+# repo ships no injected config; a downstream pipeline (e.g. SaaS) passes the
+# target project's publishable values as build args. Note: .env* is excluded by
+# .dockerignore, so these args are the only way Supabase config reaches the
+# bundle in a Docker build. vite's loadEnv merges (and prioritises) VITE_-
+# prefixed process env vars, so exporting them before `vite build` is enough.
+ARG STIRLING_FLAVOR=proprietary
+ARG VITE_BUILD_MODE=production
+ARG VITE_SUPABASE_URL=""
+# pragma: allowlist secret — Supabase publishable key (safe for client)
+ARG VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY=""
+
+# Build the application (vite root is editor/, output lands in editor/dist/).
+# Only export the Supabase overrides when provided so unset stays unset.
+RUN set -eu; \
+    export STIRLING_FLAVOR="${STIRLING_FLAVOR}"; \
+    if [ -n "${VITE_SUPABASE_URL}" ]; then export VITE_SUPABASE_URL="${VITE_SUPABASE_URL}"; fi; \
+    if [ -n "${VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY}" ]; then export VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY="${VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY}"; fi; \
+    npx vite build editor --mode "${VITE_BUILD_MODE}"

 # Production stage
 FROM nginx:alpine@sha256:b0f7830b6bfaa1258f45d94c240ab668ced1b3651c8a222aefe6683447c7bf55
@@ -35,4 +71,4 @@ EXPOSE 80
 ENV VITE_API_BASE_URL=http://backend:8080

 # Use custom entrypoint
-ENTRYPOINT ["/entrypoint.sh"]
+ENTRYPOINT ["/entrypoint.sh"]