Dockerfile

FROM golang:1.25.12-bookworm

# Install system dependencies in a single layer with aggressive cleanup
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    tini \
    python3 \
    python3-pip \
    curl \
    ca-certificates \
    ffmpeg \
    aria2 \
    unzip \
    # Playwright browser dependencies
    libnss3 \
    libnspr4 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libdbus-1-3 \
    libdrm2 \
    libxkbcommon0 \
    libxcomposite1 \
    libxdamage1 \
    libxext6 \
    libxfixes3 \
    libxrandr2 \
    libgbm1 \
    libpango-1.0-0 \
    libcairo2 \
    libasound2 \
    libatspi2.0-0 \
    libgtk-3-0 \
    libxss1 \
    fonts-liberation \
    libappindicator3-1 \
    lsb-release \
    xdg-utils \
    wget \
    vainfo \
    mesa-va-drivers \
    va-driver-all \
    libva2 \
    libva-drm2 \
    && pip3 install --break-system-packages --no-cache-dir itch-dl \
    && apt-get autoremove -y \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /root/.cache

# yt-dlp is intentionally installed from the nightly (--pre) channel because
# Instagram breaks extractors faster than stable releases ship. This remote ADD
# invalidates Docker's cache whenever the latest nightly release changes, so a
# Coolify rebuild actually refreshes yt-dlp instead of reusing a stale layer.
ADD https://api.github.com/repos/yt-dlp/yt-dlp-nightly-builds/releases/latest /tmp/yt-dlp-nightly-release.json
RUN pip3 install --break-system-packages --no-cache-dir --upgrade --pre "yt-dlp[default,curl-cffi]" \
    && yt-dlp --version > /etc/yt-dlp-version \
    && rm -rf /root/.cache

# gallery-dl handles photo posts and mixed photo/video carousels, which yt-dlp
# rejects outright. Its extractors break on the same cadence as yt-dlp's, so the
# remote ADD cache-busts on the latest release for the same reason.
#
# It is installed into the SAME environment as yt-dlp on purpose: gallery-dl's
# default Instagram video path hands DASH manifests to yt-dlp as an importable
# Python module, and silently falls back to lower-quality pre-merged MP4 when it
# cannot import one. requests[socks] is what makes a socks5:// value in
# YTDLP_PROXY work rather than warn and bypass the proxy.
ADD https://api.github.com/repos/mikf/gallery-dl/releases/latest /tmp/gallery-dl-release.json
RUN pip3 install --break-system-packages --no-cache-dir --upgrade gallery-dl "requests[socks]" \
    && gallery-dl --version > /etc/gallery-dl-version \
    && rm -rf /root/.cache

# The Docker image includes curl-cffi, so use yt-dlp's browser impersonation by
# default for Instagram/TikTok/Facebook anti-bot responses. Arker applies this
# only to those URL families. Override to empty to disable, or to another target
# accepted by `yt-dlp --list-impersonate-targets`.
ENV YTDLP_IMPERSONATE=chrome

# Install Deno
RUN curl -fsSL https://deno.land/install.sh | sh
ENV DENO_INSTALL="/root/.deno"
ENV PATH="${DENO_INSTALL}/bin:${PATH}"

# Install Playwright CLI early for better caching
RUN go install github.com/mxschmitt/playwright-go/cmd/playwright@v0.6100.0
ENV PATH="/root/go/bin:${PATH}"

# Install Playwright browser in separate layer (cached unless Playwright version changes)
RUN playwright install-deps && \
    playwright install --with-deps chromium && \
    playwright --version

WORKDIR /app

# Copy go.mod and go.sum first for dependency caching
COPY go.mod go.sum ./
RUN go mod download

# Copy source code and build (this layer rebuilds on code changes)
COPY . .
RUN go build -o arker ./cmd

# Create necessary directories
RUN mkdir -p /data /cache

EXPOSE 8080

# tini reaps the zombie headless_shell/browser children that arker's own PID-1
# process never wait()s on. Without an init, prod accumulates ~1k defunct PIDs
# per day and eventually hits the container's pids cgroup limit, at which point
# archiving breaks with fork failures.
ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["./arker"]