Dockerfile

ARG BASE_VERSION=24.04

ARG BASE_IMAGE=ubuntu:$BASE_VERSION

FROM ${BASE_IMAGE} AS documentserver-base
LABEL maintainer="Ascensio System SIA <support@onlyoffice.com>"

ARG BASE_VERSION
ARG PG_VERSION=16
ARG PACKAGE_SUFFIX=t64

ENV OC_RELEASE_NUM=23
ENV OC_RU_VER=7
ENV OC_RU_REVISION_VER=0
ENV OC_RESERVED_NUM=25
ENV OC_RU_DATE=01
ENV OC_PATH=${OC_RELEASE_NUM}${OC_RU_VER}0000
ENV OC_FILE_SUFFIX=${OC_RELEASE_NUM}.${OC_RU_VER}.${OC_RU_REVISION_VER}.${OC_RESERVED_NUM}.${OC_RU_DATE}
ENV OC_VER_DIR=${OC_RELEASE_NUM}_${OC_RU_VER}
ENV OC_DOWNLOAD_URL=https://download.oracle.com/otn_software/linux/instantclient/${OC_PATH}

ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8 DEBIAN_FRONTEND=noninteractive PG_VERSION=${PG_VERSION} BASE_VERSION=${BASE_VERSION}

ARG ONLYOFFICE_VALUE=onlyoffice
COPY fonts/ /usr/share/fonts/truetype/

RUN echo "#!/bin/sh\nexit 101" > /usr/sbin/policy-rc.d && \
    apt-get -y update && \
    apt-get -yq install wget apt-transport-https gnupg locales lsb-release && \
    locale-gen en_US.UTF-8 && \
    echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true | debconf-set-selections && \
    ACCEPT_EULA=Y apt-get -yq install \
        adduser \
        apt-utils \
        bomstrip \
        certbot \
        cron \
        curl \
        htop \
        libasound2${PACKAGE_SUFFIX} \
        libcairo2 \
        libcurl3-gnutls \
        libcurl4 \
        libgtk-3-0 \
        libnspr4 \
        libnss3 \
        libstdc++6 \
        libxml2 \
        libxss1 \
        libxtst6 \
        nano \
        net-tools \
        netcat-openbsd \
        nginx-extras \
        pwgen \
        sudo \
        supervisor \
        ttf-mscorefonts-installer \
        unzip \
        xvfb \
        xxd \
        zlib1g && \
    if [  $(find /usr/share/fonts/truetype/msttcorefonts -maxdepth 1 -type f -iname '*.ttf' | wc -l) -lt 30 ]; \
        then echo 'msttcorefonts failed to download'; exit 1; fi  && \
    rm -rf /var/lib/apt/lists/*

COPY config/supervisor/supervisor /etc/init.d/
COPY config/supervisor/ds/*.conf /etc/supervisor/conf.d/
COPY run-document-server.sh /app/ds/run-document-server.sh

EXPOSE 8080

ARG COMPANY_NAME=onlyoffice
ARG PRODUCT_NAME=documentserver
ARG PRODUCT_EDITION=
ARG PACKAGE_VERSION=
ARG TARGETARCH
ARG PACKAGE_BASEURL="http://download.onlyoffice.com/install/documentserver/linux"

ENV COMPANY_NAME=$COMPANY_NAME \
    PRODUCT_NAME=$PRODUCT_NAME \
    PRODUCT_EDITION=$PRODUCT_EDITION \
    DS_PLUGIN_INSTALLATION=false \
    DS_DOCKER_INSTALLATION=true \
    PLUGINS_ENABLED=false \
    GENERATE_FONTS=false

RUN if [ -n "${PRODUCT_EDITION}" ]; then \
    wget -q -O /etc/apt/sources.list.d/mssql-release.list "https://packages.microsoft.com/config/ubuntu/$BASE_VERSION/prod.list" && \
    wget -q -O /tmp/microsoft.asc https://packages.microsoft.com/keys/microsoft.asc && \
    apt-key add /tmp/microsoft.asc && \
    gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg < /tmp/microsoft.asc && \
    apt-get -y update && \
    ACCEPT_EULA=Y apt-get -yq install \
        libaio1${PACKAGE_SUFFIX} \
        libboost-regex-dev \
        mssql-tools18 \
        mysql-client \
        unixodbc-dev \
        redis-server \
        postgresql postgresql-client \
        rabbitmq-server && \
    dpkg --configure -a && \
    wget -O basic.zip ${OC_DOWNLOAD_URL}/instantclient-basic-linux.$(dpkg --print-architecture | sed 's/amd64/x64/')-${OC_FILE_SUFFIX}.zip && \
    wget -O sqlplus.zip ${OC_DOWNLOAD_URL}/instantclient-sqlplus-linux.$(dpkg --print-architecture | sed 's/amd64/x64/')-${OC_FILE_SUFFIX}.zip && \
    unzip -o basic.zip -d /usr/share && \
    unzip -o sqlplus.zip -d /usr/share && \
    rm -f basic.zip sqlplus.zip && \
    mv /usr/share/instantclient_${OC_VER_DIR} /usr/share/instantclient && \
    find /usr/lib /lib -name "libaio.so.1$PACKAGE_SUFFIX" -exec bash -c 'ln -sf "$0" "$(dirname "$0")/libaio.so.1"' {} \; && \
    sed -i "s/bind .*/bind 127.0.0.1/g" /etc/redis/redis.conf && \
    echo "SERVER_ADDITIONAL_ERL_ARGS=\"+S 1:1\"" | tee -a /etc/rabbitmq/rabbitmq-env.conf && \
    pg_conftool $PG_VERSION main set listen_addresses 'localhost' && \
    service postgresql start && \
    sudo -u postgres psql -c "CREATE USER $ONLYOFFICE_VALUE WITH password '$ONLYOFFICE_VALUE';" && \
    sudo -u postgres psql -c "CREATE DATABASE $ONLYOFFICE_VALUE OWNER $ONLYOFFICE_VALUE;" && \
    service postgresql stop && \
    rm -rf /var/lib/apt/lists/*; fi

RUN PACKAGE_FILE="${COMPANY_NAME}-${PRODUCT_NAME}${PRODUCT_EDITION}${PACKAGE_VERSION:+_$PACKAGE_VERSION}_${TARGETARCH:-$(dpkg --print-architecture)}.deb" && \
    wget -q -P /tmp "$PACKAGE_BASEURL/$PACKAGE_FILE" && \
    apt-get -y update && \
    [ -n "${PRODUCT_EDITION}" ] && service postgresql start || true && \
    apt-get -yq install /tmp/$PACKAGE_FILE && \
    if [ -n "${PRODUCT_EDITION}" ]; then \
        PGPASSWORD=$ONLYOFFICE_VALUE dropdb -h localhost -p 5432 -U $ONLYOFFICE_VALUE $ONLYOFFICE_VALUE && \
        sudo -u postgres psql -c "DROP ROLE onlyoffice;" && \
        service postgresql stop; \
    else \
        rm -f /etc/supervisor/conf.d/ds-adminpanel.conf && \
        sed -i 's/,adminpanel//' /etc/supervisor/conf.d/ds.conf; \
    fi && \
    chmod 755 /etc/init.d/supervisor && \
    sed "s/COMPANY_NAME/${COMPANY_NAME}/g" -i /etc/supervisor/conf.d/*.conf && \
    service supervisor stop && \
    chmod 755 /app/ds/*.sh && \
    rm -f /tmp/$PACKAGE_FILE && \
    rm -rf /var/log/$COMPANY_NAME && \
    rm -rf /var/lib/apt/lists/*

FROM documentserver-base AS documentserver-enterprise
COPY oracle/sqlplus /usr/bin/sqlplus
VOLUME /var/log/$COMPANY_NAME /var/lib/$COMPANY_NAME /var/www/$COMPANY_NAME/Data /var/lib/postgresql /var/lib/rabbitmq /var/lib/redis /usr/share/fonts/truetype/custom
ENTRYPOINT ["/app/ds/run-document-server.sh"]

# --- Rootless hardening (community) ------------------------------------------
# Last stage on purpose: the staging workflow builds without --target, so the
# default image is this rootless community build.
# Normalize `ds` to UID/GID 1001, move every runtime-writable path into
# /app/defaults/ and symlink each original location to /tmp/... so the
# container can run with runAsNonRoot / readOnlyRootFilesystem / cap drop ALL
# and a single emptyDir on /tmp (plus a volume on /var/www/.../Data).
#
# Nginx stays in front of docservice (it owns the ONLYOFFICE version-prefix
# rewrite and the /web-apps alias rules). Ports: nginx :8000 (external),
# docservice :8001 (localhost only).
FROM documentserver-base AS documentserver-community
COPY config/supervisor/supervisord.rootless.conf /app/defaults/etc/supervisor/supervisord.conf

RUN set -eux; \
    # Bake editor runtime artifacts at build time (rootfs is RO at runtime).
    documentserver-generate-allfonts.sh true true && \
    mkdir -p /etc/nginx/includes && \
    documentserver-flush-cache.sh -r false && \
    test -s /var/www/$COMPANY_NAME/documentserver/sdkjs/common/AllFonts.js && \
    test -s /var/www/$COMPANY_NAME/documentserver/web-apps/apps/api/documents/api.js && \
    # Move docservice from :8000 to :8001 so nginx can own :8000 externally.
    /var/www/$COMPANY_NAME/documentserver/npm/json -I \
        -f /etc/$COMPANY_NAME/documentserver/local.json \
        -e "this.services=this.services||{}; this.services.CoAuthoring=this.services.CoAuthoring||{}; this.services.CoAuthoring.server=this.services.CoAuthoring.server||{}; this.services.CoAuthoring.server.port=8001" && \
    sed -i 's|server localhost:8000|server localhost:8001|g' \
        /etc/$COMPANY_NAME/documentserver/nginx/includes/http-common.conf && \
    groupmod -g 1001 ds && usermod -u 1001 -g 1001 ds && \
    mkdir -p /app/defaults/etc /app/defaults/log /app/defaults/lib /app/defaults/cache && \
    mv /etc/$COMPANY_NAME          /app/defaults/etc/$COMPANY_NAME && \
    mv /etc/nginx                  /app/defaults/etc/nginx && \
    cp -rn /etc/supervisor/.       /app/defaults/etc/supervisor/ && \
    rm -rf /etc/supervisor && \
    ([ -d /var/lib/$COMPANY_NAME ] && mv /var/lib/$COMPANY_NAME /app/defaults/lib/$COMPANY_NAME || mkdir -p /app/defaults/lib/$COMPANY_NAME) && \
    ([ -d /var/lib/nginx ]          && mv /var/lib/nginx         /app/defaults/lib/nginx         || mkdir -p /app/defaults/lib/nginx) && \
    ([ -d /var/cache/nginx ]        && mv /var/cache/nginx       /app/defaults/cache/nginx       || mkdir -p /app/defaults/cache/nginx) && \
    mkdir -p /app/defaults/log/$COMPANY_NAME /app/defaults/log/nginx /app/defaults/log/supervisor && \
    ln -s /tmp/etc/$COMPANY_NAME   /etc/$COMPANY_NAME && \
    ln -s /tmp/etc/nginx           /etc/nginx && \
    ln -s /tmp/etc/supervisor      /etc/supervisor && \
    rm -rf /var/log/$COMPANY_NAME  && ln -s /tmp/log/$COMPANY_NAME /var/log/$COMPANY_NAME && \
    rm -rf /var/log/nginx          && ln -s /tmp/log/nginx         /var/log/nginx && \
    rm -rf /var/log/supervisor     && ln -s /tmp/log/supervisor    /var/log/supervisor && \
    ln -s /tmp/lib/$COMPANY_NAME   /var/lib/$COMPANY_NAME && \
    ln -s /tmp/lib/nginx           /var/lib/nginx && \
    ln -s /tmp/cache/nginx         /var/cache/nginx && \
    rm -rf /run                    && ln -s /tmp/run               /run && \
    mkdir -p /usr/share/ca-certificates && ln -s /tmp/ca-ds /usr/share/ca-certificates/ds && \
    # Nginx rootless: no master setuid, pid outside /tmp/run (K8s SA secret
    # hijacks that dir with perms we can't write), bind on 8000 instead of 80.
    sed -i 's|^\s*user .*|# user disabled for rootless|' /app/defaults/etc/nginx/nginx.conf && \
    sed -i 's|^\s*pid .*|pid /tmp/nginx.pid;|'           /app/defaults/etc/nginx/nginx.conf && \
    find /app/defaults/etc/nginx /app/defaults/etc/$COMPANY_NAME -type f \( -name '*.conf' -o -name '*.tmpl' \) \
        -exec sed -i -E \
            -e 's/(listen\s+[^ ;]+):80\b/\1:8000/g' \
            -e 's/(listen\s+)80\b/\18000/g' {} + && \
    chown -R 1001:1001 /app /var/www/$COMPANY_NAME

VOLUME /var/www/$COMPANY_NAME/Data /usr/share/fonts/truetype/custom

USER 1001

ENTRYPOINT ["/app/ds/run-document-server.sh"]