Building Littlefedi Docker Image

xyzzy.cafe is powered by littlefedi. I'm running it inside a docker compose setup — which requires a littlefedi docker image to start with:

FROM golang:1.27 AS build

WORKDIR /usr/src/littlefedi

# pre-copy/cache go.mod for pre-downloading dependencies and only redownloading them in subsequent builds if they change
COPY src/go.mod src/go.sum ./
RUN go mod download

COPY src .
RUN make build-blog

FROM debian:trixie-slim
RUN apt-get update && \
    apt install -y --no-install-recommends ca-certificates gosu procps && \
    rm -rf /var/lib/apt/lists/*
COPY --from=build /usr/src/littlefedi/littlefedi-blog /bin/littlefedi
EXPOSE 8080
# Create default app (UID/GID 1000)
RUN groupadd --gid 1000 app && \
    useradd --uid 1000 --gid 1000 --comment "" app
RUN mkdir /config 
RUN mkdir /data
RUN mkdir /backup
VOLUME /config
VOLUME /data
VOLUME /backup
COPY entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/entrypoint.sh

ENTRYPOINT ["entrypoint.sh"]
CMD ["/bin/littlefedi", "--config", "/config/littlefedi.toml"]

I'm using the "official" golang docker image here to build littlefedi from the expanded littlefedi source tar placed in the src subdirectory.

A couple of notes:

• I want to have the blog-enabled variant of littlefedi, hence the make build-blog incantation.

• I'm pretty much only interested in the littlefedi binary, thus, the multi-stage docker file: I pull a slim Debian image for the final docker image and copy the generated littlefedi-blog into it (renaming it to littlefedi).

• To enable littlefedi to do TLS certificate verifications we need the ca-certificates package installed, we need gosu to run littelfedi as non-root, the procps package to install ps (for debugging).

• Given that this is a slim docker container image I just went with

  instead of faffing around with linux filesystem hierarchy standard compliant folder names.

  • /config to hold the littlefedi.toml configuration file,
  • /data to store media
  • /backup to hold littlefedi's backups

To ensure that mounted volumes (/config, data, /backup) are accessible from outside the docker image entrypoint.sh obtains the UID and GID from the mounted /config volume and modifies the app user and group to match:

#!/bin/bash

CONFIG_UID=$(stat -c '%u' /config)
CONFIG_GID=$(stat -c '%g' /config)

usermod -u "${CONFIG_UID}" app
groupmod -g "${CONFIG_GID}" app

# ensure uid:gid are as intended for 
for v in /config /data /backup ; do
    chown -R app:app ${v}  
done

# run the passed-in args (or CMD if none provided)
exec gosu app "$@"

Using gosu we then run littelfedi (or whatever we pass in as commands) as user app:app.

#littlefedi #docker #dockerfile