Add a Dockerfile for a container deployment (RunPod-friendly)

A small (~250 MB) single-stage image: it pulls the latest release binary
onto nvidia/cuda:*-base and sets NVIDIA_DRIVER_CAPABILITIES so the runtime
mounts libcuda + libnvidia-ml. No CUDA toolkit, no GUI libs (the tray
degrades to headless), and TLS roots are bundled, so nothing else is
needed at run time. ENTRYPOINT runs the worker against a /data volume.

This is the clean "run it permanently" answer for container hosts like
RunPod, which have no systemd: the container runtime re-runs the entrypoint
on every start, so the worker comes up automatically and survives restarts.
`.dockerignore` keeps the build context empty (nothing is copied from the
repo — the binary is fetched). README gains a "Run in a container" section.

Image builds clean and carries the binary; verified the identical release
binary already runs on a RunPod RTX 4090.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MagicalTux

.dockerignore

@@ -0,0 +1,3 @@
+# The Dockerfile pulls the release binary; nothing from the repo is needed in the
+# build context, so ignore everything (keeps the context tiny — no multi-GB target/).
+*

Dockerfile

@@ -0,0 +1,42 @@
+# decryptd — GPU worker for decrypt, as a small self-contained container.
+#
+# The image carries just the release binary. Everything GPU-related — libcuda and
+# libnvidia-ml — is injected at runtime by the NVIDIA container runtime, so there's
+# no CUDA toolkit here. decryptd also needs no GUI libraries (the tray degrades to
+# headless) and bundles its own TLS roots, so nothing else is required at runtime.
+#
+# Build:
+#   docker build -t decryptd .
+# Run (needs the NVIDIA container runtime; `--restart` makes it permanent):
+#   docker run -d --name decryptd --restart unless-stopped --gpus all \
+#     -v decryptd-data:/data decryptd
+#
+# On RunPod: push this image to a registry and use it as the pod's image — RunPod
+# runs the entrypoint on every start, so the worker comes up automatically and
+# survives restarts. Mount a volume at /data to keep the worker id + cache.
+FROM nvidia/cuda:12.4.1-base-ubuntu22.04
+
+LABEL org.opencontainers.image.source="https://github.com/KarpelesLab/decryptd" \
+      org.opencontainers.image.description="GPU worker for decrypt"
+
+# Expose the host GPU through the NVIDIA runtime: `compute` = CUDA (libcuda),
+# `utility` = NVML/nvidia-smi (the tray's temperature/power readout).
+ENV NVIDIA_VISIBLE_DEVICES=all \
+    NVIDIA_DRIVER_CAPABILITIES=compute,utility
+
+# Fetch the latest release binary. curl + ca-certificates are needed only to
+# download it at build time and are removed in the same layer to keep the image
+# lean. Override --build-arg DECRYPTD_URL=... to pin a specific version.
+ARG DECRYPTD_URL=https://github.com/KarpelesLab/decryptd/releases/latest/download/decryptd-linux-x86_64.tar.gz
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates curl; \
+    curl -fSL "$DECRYPTD_URL" | tar -xz --no-same-owner -C /usr/local/bin decryptd; \
+    chmod +x /usr/local/bin/decryptd; \
+    apt-get purge -y --auto-remove curl ca-certificates; \
+    rm -rf /var/lib/apt/lists/*
+
+# Persist the worker id + download cache across restarts by mounting a volume here.
+VOLUME /data
+WORKDIR /data
+ENTRYPOINT ["/usr/local/bin/decryptd", "--workdir", "/data"]

README.md

@@ -67,6 +67,24 @@ nohup ./decryptd >decryptd.log 2>&1 &
 For an always-on contributor, run it under a service manager (systemd on Linux,
 a scheduled task / service on Windows) so it restarts on boot.
 
+### Run in a container
+
+The included `Dockerfile` builds a small (~250 MB) image containing just the
+worker. The GPU is supplied at run time by the
+[NVIDIA container runtime](https://github.com/NVIDIA/nvidia-container-toolkit) —
+no CUDA toolkit or GUI libraries go in the image.
+
+```sh
+docker build -t decryptd .
+docker run -d --name decryptd --restart unless-stopped --gpus all \
+  -v decryptd-data:/data decryptd
+```
+
+Mount a volume at `/data` to keep the worker id and download cache across
+restarts. On **RunPod** (or any container host), push the image to a registry and
+use it as the pod's image: the entrypoint launches the worker, so it starts
+automatically and comes back after a restart — no systemd needed.
+
 ### Options
 
 You normally don't need any of these.