From c03f135cb90eda616e0aa7dc057cbb86b9736c9c Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 5 Mar 2026 09:46:08 +0000
Subject: [PATCH] Optimize Dockerfile and repository structure

- Consolidate multiple RUN layers into a single instruction to reduce image size.
- Implement a non-root user 'nut' (UID 1000) for improved security.
- Refactor the fetching and patching logic using curl and tar.
- Add a .dockerignore file to exclude unnecessary files from the build context.
- Update the README.md to reflect the new non-root user and revised volume paths (/app/conf, /app/_NSPOUT).
- Ensure build-time dependencies (gcc, -dev libraries) are removed after installation.
- Patch requirements.txt to remove GUI dependencies and add markupsafe==2.0.1 for stability.

Co-authored-by: eskwisit <47784621+eskwisit@users.noreply.github.com>
---
 .dockerignore |  7 ++++++
 Dockerfile    | 68 +++++++++++++++++++++++++--------------------------
 README.md     |  8 ++++--
 3 files changed, 46 insertions(+), 37 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..28e3cf0
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+.git
+.gitignore
+Dockerfile
+README.md
+*.log
+__pycache__
+.dockerignore
diff --git a/Dockerfile b/Dockerfile
index 118a285..b6a2a9a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,42 +5,40 @@ LABEL description='Slim Docker container featuring embedded Nut server from blaw
 LABEL repo='eskwisit/nut-server'
 LABEL email='mru2683@gmail.com'
 
-# Prepare Nut install
-RUN apt-get update && apt-get -y install \
-	wget \
-	unzip \
-	gcc \
-	libssl-dev \
-	libcurl4-openssl-dev \
-	zlib1g-dev \
-	libjpeg-dev
-
-# Fetch Nut codebase
-RUN wget https://github.com/blawar/nut/archive/refs/tags/v3.3.zip
-RUN unzip v3.3.zip -d /root
-RUN mv /root/nut-3.3 /root/nut
-
-# Edit config
-RUN mv /root/nut/conf/nut.default.conf /root/nut/conf/nut.conf
-RUN sed -i '/scan/c "scan": ["\/titles"]' /root/nut/conf/nut.conf
-
-# Remove GUI packages
-RUN sed -i '/pyqt5/d' /root/nut/requirements.txt
-RUN sed -i '/qt-range-slider/d' /root/nut/requirements.txt
-
-# Add missing requirements
-RUN echo markupsafe==2.0.1 >>/root/nut/requirements.txt
-
-# Install project dependencies
-RUN pip3 install -U pip
-RUN pip3 install -r /root/nut/requirements.txt
-
-VOLUME [ "/titles", "/root/nut/conf", "/root/nut/_NSPOUT" ]
+# Create non-root user
+RUN groupadd -g 1000 nut && \
+    useradd -u 1000 -g nut -m -d /app nut
+
+WORKDIR /app
+
+# Install build dependencies, fetch Nut, patch, install python deps, and cleanup
+RUN apt-get update && apt-get -y install --no-install-recommends \
+    curl \
+    ca-certificates \
+    gcc \
+    libssl-dev \
+    libcurl4-openssl-dev \
+    zlib1g-dev \
+    libjpeg-dev \
+    && curl -L https://github.com/blawar/nut/archive/refs/tags/v3.3.tar.gz | tar -xz --strip-components=1 -C /app \
+    && mv /app/conf/nut.default.conf /app/conf/nut.conf \
+    && sed -i '/scan/c "scan": ["\/titles"]' /app/conf/nut.conf \
+    && sed -i '/pyqt5/d' /app/requirements.txt \
+    && sed -i '/qt-range-slider/d' /app/requirements.txt \
+    && echo "markupsafe==2.0.1" >> /app/requirements.txt \
+    && pip3 install -U --no-cache-dir pip \
+    && pip3 install --no-cache-dir -r /app/requirements.txt \
+    && apt-get purge -y --auto-remove curl gcc libssl-dev libcurl4-openssl-dev zlib1g-dev libjpeg-dev \
+    && apt-get install -y --no-install-recommends libcurl4 libjpeg62-turbo \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /titles /app/_NSPOUT /app/conf \
+    && chown -R nut:nut /app /titles
+
+VOLUME [ "/titles", "/app/conf", "/app/_NSPOUT" ]
 
 EXPOSE 9000
 
-# clean up
-RUN rm v3.3.zip
-RUN apt-get autoremove
+USER nut
 
-CMD ["python3", "/root/nut/nut.py", "--server"]
+CMD ["python3", "/app/nut.py", "--server"]
diff --git a/README.md b/README.md
index 7ae2e75..06b94f9 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,7 @@ Slim Docker image featuring embedded Nut server from [blawar/nut](https://github
 - Auto refresh of titles directory.
 - Zero config bundle.
 - Seamless integration for [Tinfoil](https://tinfoil.io/).
+- **Improved security:** Runs as a non-root user.
 
 ## Usage
 
@@ -18,6 +19,7 @@ Slim Docker image featuring embedded Nut server from [blawar/nut](https://github
 docker pull eskwisit/nut-server
 
 # Run image
+# Ensure your local titles directory is accessible by the 'nut' user (UID 1000)
 docker run -d --name=nut-server -v /path/to/titles:/titles:rw eskwisit/nut-server
 ```
 
@@ -27,6 +29,8 @@ If you need to tune the configuration, you can mount titles, conf and NSPOUT vol
 
 ```bash
 -v /path/to/titles:/titles:rw # For titles
--v /path/to/conf:/root/nut/conf:rw # For config files
--v /path/to/_NSPOUT:/root/nut/_NSPOUT/:rw # For NSP out
+-v /path/to/conf:/app/conf:rw # For config files
+-v /path/to/_NSPOUT:/app/_NSPOUT/:rw # For NSP out
 ```
+
+*Note: Since the container runs as a non-root user (UID 1000), you may need to adjust the permissions of your host folders to ensure the container can read/write them.*