pyr0ball
362a7499c2
Debian bookworm is frozen at June 2023 package versions. Key problem: mbedtls 2.28.3-1 (bookworm) vs mbedtls 3.6.6-r0 (Alpine 3.23) CVE-2026-34875 (9.8 critical) is fixed in mbedtls 3.6.6 — which Alpine already ships. Debian bookworm won't get that update. Similarly for 5+ other critical/high mbedtls CVEs and gnutls28 CVEs. Total: 149 CVEs on Debian bookworm vs ~36 on Alpine 3.23. Alpine's rolling model ships much newer package versions, which actually means fewer accumulated CVEs in key libraries like mbedtls, despite the reputation of 'Debian stable = secure'.
24 lines
707 B
Text
24 lines
707 B
Text
# Discarr — HandBrake variant
|
|
# Includes HandBrake for preset-based encoding and forced-subtitle burn-in.
|
|
# NOTE: Alpine's HandBrake package depends on both ffmpeg 8.x AND ffmpeg 7.x,
|
|
# which increases the CVE surface area compared to the default image.
|
|
# Use this variant only if you specifically need HandBrake features.
|
|
#
|
|
# Build: docker build -f Dockerfile.handbrake -t pyr0ball/discarr:handbrake .
|
|
|
|
FROM node:22-alpine
|
|
|
|
RUN apk upgrade --no-cache && \
|
|
apk add --no-cache \
|
|
ffmpeg \
|
|
handbrake \
|
|
openssh-client
|
|
|
|
RUN npm install -g npm@latest && npm cache clean --force
|
|
|
|
WORKDIR /app
|
|
COPY server.js scanner.js ./
|
|
COPY public/ ./public/
|
|
|
|
EXPOSE 8603
|
|
CMD ["node", "server.js"]
|