chore: adds unprivileged docker image (#1706)

Signed-off-by: Pedro Lamas <pedrolamas@gmail.com>

Author: pedrolamas

.github/workflows/build.yml

@@ -53,10 +53,22 @@ jobs:
           path: ./dist
 
   publish-docker:
-    name: Publish Docker Image
+    name: Publish ${{ matrix.type }} Image
     needs: build
     if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - type: Docker
+            image-name: ${{ github.repository }}
+            base-image: nginx:alpine
+            port: 80
+          - type: Docker Unprivileged
+            image-name: ${{ github.repository }}-unprivileged
+            base-image: nginxinc/nginx-unprivileged:alpine
+            port: 8080
     permissions:
       id-token: write
       contents: read
@@ -77,7 +89,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: |
-            ghcr.io/${{ github.repository }}
+            ghcr.io/${{ matrix.image-name }}
           tags: |
             type=semver,pattern={{raw}}
             type=ref,event=pr
@@ -105,6 +117,9 @@ jobs:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
+          build-args: |
+            BASE_IMAGE=${{ matrix.base-image }}
+            PORT=${{ matrix.port }}
           push: true
           sbom: true
           provenance: true
@@ -116,7 +131,7 @@ jobs:
       - name: Attest Docker image
         uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ghcr.io/${{ github.repository }}
+          subject-name: ghcr.io/${{ matrix.image-name }}
           subject-digest: ${{ steps.docker_push.outputs.digest }}
           push-to-registry: true
 

Dockerfile

@@ -1,6 +1,11 @@
-FROM nginx:alpine
+ARG BASE_IMAGE=nginx:alpine
+ARG PORT=80
 
-ENV PORT=80
+FROM $BASE_IMAGE
+
+ARG PORT
+
+ENV PORT=$PORT
 
 COPY /dist /usr/share/nginx/html
 COPY /server/nginx /etc/nginx/templates

README.md

@@ -31,7 +31,13 @@ Older releases can be found [here](https://github.com/fluidd-core/fluidd/release
 
 ## Docker support
 
-We have an [official docker image](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd). This is updated for each release and on each commit.
+We have an [official docker image](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd), serving Fluidd by default on port 80.
+
+For those who have specific security requirements and need/want to run an unprivileged container, we also have an [unprivileged docker image](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd-unprivileged) available, serving Fluidd by default on port 8080.
+
+You can override the default port where Fluidd will be served by setting the `PORT` environment variable when starting the docker container.
+
+Both of these docker images are updated for each release and on each commit.
 
 ## Official sponsors
 

docs/index.md

@@ -30,7 +30,8 @@ firmware.
 - [Notifications](/features/notifications) on Pi throttling + more
 - [Macro organization](/features/macros)
 - Full [localization](/development/localization) (i18n) support
-- View and Edit your Klipper config in app with code folding and Codelens support
+- View and Edit your Klipper config in app with code folding and Codelens
+support
 - View and Edit your Gcode files in app
 - [Bed Mesh](/features/bed_mesh) levelling
 - [Multiple extruder](/features/multiple_extruders) configurations
@@ -44,16 +45,20 @@ firmware.
 
 ## Supporting Fluidd
 
-Fluidd development is driven by passionate volunteers who dedicate their time to improving and expanding its capabilities.
+Fluidd development is driven by passionate volunteers who dedicate their time to
+improving and expanding its capabilities.
 
-Your sponsorship can help us enhance Fluidd, introduce new features, and ensure it remains accessible to all Klipper users.
+Your sponsorship can help us enhance Fluidd, introduce new features, and ensure
+it remains accessible to all Klipper users.
 
-Your support can make a significant impact on the evolution of Fluidd. Please consider [sponsoring Fluidd](https://github.com/sponsors/fluidd-core).
+Your support can make a significant impact on the evolution of Fluidd. Please
+consider [sponsoring Fluidd](https://github.com/sponsors/fluidd-core).
 
 ## Docker
 
-Fluidd ships with Docker support built in. The official docker can be found
-[here](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd), and further information can be found [here](/installation/docker).
+Fluidd ships with Docker support built in. The official docker image can be
+found [here](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd), and
+further information can be found [here](/installation/docker).
 
 ## Need help?
 

docs/installation/docker.md

@@ -15,8 +15,17 @@ Fluidd can be hosted with Docker. This is considered an advanced install, but
 gives you the benefit of hosting a single instance of Fluidd, and having it
 connect to multiple printers.
 
-The docker image is updated automatically with each release of Fluidd, and
-on each commit to the "master" or "develop" branches.
+We have an [official docker image](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd),
+serving Fluidd by default on port 80.
+
+For those who have specific security requirements and need/want to run an
+unprivileged container, we also have an [unprivileged docker image](https://github.com/fluidd-core/fluidd/pkgs/container/fluidd-unprivileged)
+available, serving Fluidd by default on port 8080.
+
+You can override the default port where Fluidd will be served by setting the
+`PORT` environment variable when starting the docker container.
+
+Both of these docker images are updated for each release and on each commit.
 
 This is a list of the available docker image tags: