feat: use normal users & optimize data dir & reduce image layer

Dockerfile

@@ -1,24 +1,19 @@
 FROM mlikiowa/napcat-docker:base
 
-WORKDIR /usr/src/app
+WORKDIR /app
 
-COPY NapCat.Shell.zip entrypoint.sh ./
-# 设置时区
-ENV TZ=Asia/Shanghai 
-RUN echo "${TZ}" > /etc/timezone \ 
-    && ln -sf /usr/share/zoneinfo/${TZ} /etc/localtime \ 
-    && apt update \ 
-    && apt install -y tzdata \ 
-    && rm -rf /var/lib/apt/lists/*
+COPY NapCat.Shell.zip entrypoint.sh /app/
 
 # 安装Linux QQ
 RUN arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) && \
     curl -o linuxqq.deb https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.12_240819_${arch}_01.deb && \
     dpkg -i --force-depends linuxqq.deb && rm linuxqq.deb && \
     chmod +x entrypoint.sh && \
-    echo "(async () => {await import('file:///usr/src/app/napcat/napcat.mjs');})();" > /opt/QQ/resources/app/app_launcher/index.js
-VOLUME /usr/src/app/napcat/config
-VOLUME /root/.config/QQ
+    useradd -m napcat && \
+    echo "(async () => {await import('file:///app/napcat/napcat.mjs');})();" > /opt/QQ/resources/app/app_launcher/index.js
+
+VOLUME /app/napcat/config
+VOLUME /app/.config/QQ
 
 ENTRYPOINT ["bash", "entrypoint.sh"]
 

base/Dockerfile

@@ -1,18 +1,19 @@
 FROM ubuntu:22.04
 
 # 设置环境变量
-ENV DEBIAN_FRONTEND=noninteractive
+ENV DEBIAN_FRONTEND=noninteractive \
+    TZ=Asia/Shanghai
 
 # 安装必要的软件包
 RUN apt-get update && apt-get install -y \
-    libnss3 \   
+    libnss3 \
     libnotify4 \
     libsecret-1-0 \
     libgbm1 \
     xvfb \
     libasound2 \
     fonts-wqy-zenhei \
-    gnutls-bin \ 
+    gnutls-bin \
     libglib2.0-dev \
     libdbus-1-3 \
     libgtk-3-0 \
@@ -23,7 +24,11 @@ RUN apt-get update && apt-get install -y \
     ffmpeg \
     unzip \
     dbus-user-session \
-    curl && \   
+    curl \
+    gosu \
+    tzdata && \
+    echo "${TZ}" > /etc/timezone && \ 
+    ln -sf /usr/share/zoneinfo/${TZ} /etc/localtime && \
     apt autoremove -y && \
     apt clean && \
     rm -rf \

entrypoint.sh

@@ -46,6 +46,8 @@ if [ ! -f "$CONFIG_PATH" ]; then
     : ${HTTP_HEART_ENABLE:='false'}
     : ${MUSIC_SIGN_URL:=''}
     : ${HTTP_SECRET:=''}
+    : ${NAPCAT_GID:=1001}
+    : ${NAPCAT_UID:=911}
     HTTP_URLS=$(chech_quotes $HTTP_URLS)
     WS_URLS=$(chech_quotes $WS_URLS)
 cat <<EOF > $CONFIG_PATH
@@ -82,17 +84,16 @@ cat <<EOF > $CONFIG_PATH
 }
 EOF
 fi
-FILE="/tmp/.X1-lock"
+rm -rf "/tmp/.X1-lock"
 
-if [ -e "$FILE" ]; then
-    rm -rf "$FILE"
-    echo "$FILE has been deleted."
-else
-    echo "$FILE does not exist."
-fi
+usermod -o -u ${NAPCAT_UID} napcat
+groupmod -o -g ${NAPCAT_GID} napcat
+usermod -g ${NAPCAT_GID} napcat
+chown -R ${NAPCAT_UID}:${NAPCAT_GID} /app
 
-Xvfb :1 -screen 0 1080x760x16 +extension GLX +render &
+gosu napcat Xvfb :1 -screen 0 1080x760x16 +extension GLX +render &
+sleep 2
 export FFMPEG_PATH=/usr/bin/ffmpeg
 export DISPLAY=:1
-cd ./napcat
-qq --no-sandbox -q $ACCOUNT
+cd /app/napcat
+gosu napcat /opt/QQ/qq --no-sandbox -q $ACCOUNT