Alpine's HandBrake package depends on both ffmpeg 8.x AND ffmpeg7 7.x,
doubling the ffmpeg CVE surface. HandBrake is optional (ffmpeg handles
encoding by default), so remove it from the default image.
- Dockerfile: ffmpeg + openssh-client only (removes ffmpeg7 family)
- Dockerfile.handbrake: new variant for users who need HandBrake presets
or forced-subtitle burn-in; carries the known higher CVE count
Docker Hub tags:
pyr0ball/discarr:latest / 0.1.2 — lean, ffmpeg only
pyr0ball/discarr:handbrake — includes HandBrake (more CVEs)
