Dockerfile

# Binary selector stage — picks the correct pre-built binary for the target platform.
# Docker automatically sets TARGETARCH and TARGETVARIANT during multi-platform builds.
# All pre-built binaries must be in bin/ in the build context.
FROM alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS binary-selector

ARG TARGETARCH
ARG TARGETVARIANT

COPY bin/ofelia-linux-* /tmp/

# Select binary matching the target platform.
# For ARM, Docker buildx sets TARGETVARIANT to "v6", "v7", etc.
# Pre-built binaries follow the naming: ofelia-linux-{386,amd64,arm64,armv6,armv7}
RUN set -eux; \
  case "${TARGETARCH}" in \
    arm) BINARY="ofelia-linux-arm${TARGETVARIANT}" ;; \
    386|amd64|arm64) BINARY="ofelia-linux-${TARGETARCH}" ;; \
    *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
  esac; \
  cp "/tmp/${BINARY}" /usr/bin/ofelia; \
  chmod +x /usr/bin/ofelia

# Runtime stage
FROM alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

# OCI Image Annotations
# See: https://github.com/opencontainers/image-spec/blob/main/annotations.md
# Dynamic labels (created, version, revision) are added by docker/metadata-action in CI
LABEL org.opencontainers.image.title="Ofelia" \
      org.opencontainers.image.description="A docker job scheduler (based on mcuadros/ofelia)" \
      org.opencontainers.image.url="https://github.com/netresearch/ofelia" \
      org.opencontainers.image.documentation="https://github.com/netresearch/ofelia#readme" \
      org.opencontainers.image.source="https://github.com/netresearch/ofelia" \
      org.opencontainers.image.vendor="Netresearch DTT GmbH" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.authors="Netresearch DTT GmbH <info@netresearch.de>" \
      org.opencontainers.image.base.name="alpine:3.23"

# This label is required to identify container with ofelia running
LABEL ofelia.service=true \
      ofelia.enabled=true

# tini is used as init process (PID 1) to properly reap zombie processes
# from local jobs. See: https://github.com/krallin/tini
# hadolint ignore=DL3018
RUN apk add --no-cache ca-certificates tini tzdata

COPY --from=binary-selector /usr/bin/ofelia /usr/bin/ofelia

HEALTHCHECK --interval=10s --timeout=3s --start-period=30s --retries=3 \
  CMD pgrep ofelia >/dev/null || exit 1

# Use tini as init to handle zombie process reaping
# The -g flag ensures tini kills the entire process group on signal
ENTRYPOINT ["/sbin/tini", "-g", "--", "/usr/bin/ofelia"]

CMD ["daemon", "--config", "/etc/ofelia/config.ini"]