Merge pull request #172 from linuxserver/master-3.21

Author: thespad

Dockerfile

@@ -2,7 +2,7 @@
 
 FROM ghcr.io/linuxserver/unrar:latest AS unrar
 
-FROM ghcr.io/linuxserver/baseimage-alpine:3.20 AS buildstage
+FROM ghcr.io/linuxserver/baseimage-alpine:3.21 AS buildstage
 
 # set NZBGET version
 ARG NZBGET_RELEASE
@@ -37,16 +37,16 @@ RUN \
   rm -rf /app/nzbget/bin/ && \
   rm -rf /app/nzbget/etc/ && \
   sed -i \
-    -e "s|^MainDir=.*|MainDir=/downloads|g" \
+    -e "s|^MainDir=.*|MainDir=/config|g" \
     -e "s|^ScriptDir=.*|ScriptDir=$\{MainDir\}/scripts|g" \
     -e "s|^WebDir=.*|WebDir=$\{AppDir\}/webui|g" \
     -e "s|^ConfigTemplate=.*|ConfigTemplate=$\{AppDir\}/webui/nzbget.conf.template|g" \
     -e "s|^UnrarCmd=.*|UnrarCmd=unrar|g" \
     -e "s|^SevenZipCmd=.*|SevenZipCmd=7z|g" \
     -e "s|^CertStore=.*|CertStore=$\{AppDir\}/cacert.pem|g" \
     -e "s|^CertCheck=.*|CertCheck=yes|g" \
-    -e "s|^DestDir=.*|DestDir=$\{MainDir\}/completed|g" \
-    -e "s|^InterDir=.*|InterDir=$\{MainDir\}/intermediate|g" \
+    -e "s|^DestDir=.*|DestDir=/downloads/completed|g" \
+    -e "s|^InterDir=.*|InterDir=/downloads/intermediate|g" \
     -e "s|^LogFile=.*|LogFile=$\{MainDir\}/nzbget.log|g" \
     -e "s|^AuthorizedIP=.*|AuthorizedIP=127.0.0.1|g" \
   /app/nzbget/share/nzbget/nzbget.conf && \
@@ -58,7 +58,7 @@ RUN \
   curl -o /app/nzbget/cacert.pem -L "https://curl.se/ca/cacert.pem"
 
 # Runtime Stage
-FROM ghcr.io/linuxserver/baseimage-alpine:3.20
+FROM ghcr.io/linuxserver/baseimage-alpine:3.21
 
 # set version label
 ARG BUILD_DATE
@@ -83,7 +83,7 @@ RUN \
   pip install -U --no-cache-dir \
     pip \
     wheel && \
-  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.20/ \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.21/ \
     apprise \
     pynzb \
     requests && \

Dockerfile.aarch64

@@ -2,7 +2,7 @@
 
 FROM ghcr.io/linuxserver/unrar:arm64v8-latest AS unrar
 
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.20 AS buildstage
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.21 AS buildstage
 
 # set NZBGET version
 ARG NZBGET_RELEASE
@@ -37,16 +37,16 @@ RUN \
   rm -rf /app/nzbget/bin/ && \
   rm -rf /app/nzbget/etc/ && \
   sed -i \
-    -e "s|^MainDir=.*|MainDir=/downloads|g" \
+    -e "s|^MainDir=.*|MainDir=/config|g" \
     -e "s|^ScriptDir=.*|ScriptDir=$\{MainDir\}/scripts|g" \
     -e "s|^WebDir=.*|WebDir=$\{AppDir\}/webui|g" \
     -e "s|^ConfigTemplate=.*|ConfigTemplate=$\{AppDir\}/webui/nzbget.conf.template|g" \
     -e "s|^UnrarCmd=.*|UnrarCmd=unrar|g" \
     -e "s|^SevenZipCmd=.*|SevenZipCmd=7z|g" \
     -e "s|^CertStore=.*|CertStore=$\{AppDir\}/cacert.pem|g" \
     -e "s|^CertCheck=.*|CertCheck=yes|g" \
-    -e "s|^DestDir=.*|DestDir=$\{MainDir\}/completed|g" \
-    -e "s|^InterDir=.*|InterDir=$\{MainDir\}/intermediate|g" \
+    -e "s|^DestDir=.*|DestDir=/downloads/completed|g" \
+    -e "s|^InterDir=.*|InterDir=/downloads/intermediate|g" \
     -e "s|^LogFile=.*|LogFile=$\{MainDir\}/nzbget.log|g" \
     -e "s|^AuthorizedIP=.*|AuthorizedIP=127.0.0.1|g" \
   /app/nzbget/share/nzbget/nzbget.conf && \
@@ -58,7 +58,7 @@ RUN \
   curl -o /app/nzbget/cacert.pem -L "https://curl.se/ca/cacert.pem"
 
 # Runtime Stage
-FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.20
+FROM ghcr.io/linuxserver/baseimage-alpine:arm64v8-3.21
 
 # set version label
 ARG BUILD_DATE
@@ -83,7 +83,7 @@ RUN \
   pip install -U --no-cache-dir \
     pip \
     wheel && \
-  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.20/ \
+  pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/alpine-3.21/ \
     apprise \
     pynzb \
     requests && \

README.md

@@ -88,6 +88,14 @@ Use the optional paths if you don't understand, or don't want hardlinks/atomic m
 
 The folks over at servarr.com wrote a good [write-up](https://wiki.servarr.com/docker-guide#consistent-and-well-planned-paths) on how to get started with this.
 
+## Read-Only Operation
+
+This image can be run with a read-only container filesystem. For details please [read the docs](https://docs.linuxserver.io/misc/read-only/).
+
+## Non-Root Operation
+
+This image can be run with a non-root user. For details please [read the docs](https://docs.linuxserver.io/misc/non-root/).
+
 ## Usage
 
 To help you get started creating a container from this image you can either use docker-compose or the docker cli.
@@ -148,6 +156,8 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e NZBGET_PASS=tegbzn6789` | Specify the password for web authentication. |
 | `-v /config` | Persistent config |
 | `-v /downloads` | Location of downloads on disk. |
+| `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
+| `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |
 
 ## Environment variables from files (Docker secrets)
 

readme-vars.yml

@@ -34,6 +34,8 @@ opt_param_usage_include_env: true
 opt_param_env_vars:
   - {env_var: "NZBGET_USER", env_value: "nzbget", desc: "Specify the user for web authentication."}
   - {env_var: "NZBGET_PASS", env_value: "tegbzn6789", desc: "Specify the password for web authentication."}
+readonly_supported: true
+nonroot_supported: true
 # application setup block
 app_setup_block_enabled: true
 app_setup_block: |

root/etc/s6-overlay/s6-rc.d/init-nzbget-config/run

@@ -1,27 +1,25 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
-if [[ ! -d /downloads ]]; then
-    mkdir -p /downloads
-fi
-
-# delete lock file if found
-if [[ -f /downloads/nzbget.lock ]]; then
-    rm /downloads/nzbget.lock
-fi
-
 # check if config file exists in /config
 if [[ ! -f /config/nzbget.conf ]]; then
     cp /app/nzbget/share/nzbget/nzbget.conf /config/nzbget.conf
 fi
 
-# permissions
-lsiown abc:abc \
-    /downloads
+# delete lock file if found
+if [[ -f /config/nzbget.lock ]]; then
+    rm /config/nzbget.lock
+fi
 
-lsiown -R abc:abc \
-    /app/nzbget \
-    /config
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    if grep -qe ' /downloads ' /proc/mounts; then
+        lsiown abc:abc \
+            /downloads
+    fi
 
-chmod u+rw \
-    /config/nzbget.conf
+    lsiown -R abc:abc \
+        /config
+
+    chmod u+rw \
+        /config/nzbget.conf
+fi

root/etc/s6-overlay/s6-rc.d/svc-nzbget/run

@@ -11,7 +11,14 @@ if [[ ${NZBGET_PASS} && ${NZBGET_PASS-x} ]]; then
     OPTIONS+="-o ControlPassword=${NZBGET_PASS} "
 fi
 
-exec \
-    s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 6789" \
-        s6-setuidgid abc /app/nzbget/nzbget -s -c /config/nzbget.conf \
-        -o OutputMode=log ${OPTIONS}
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 6789" \
+            s6-setuidgid abc /app/nzbget/nzbget -s -c /config/nzbget.conf \
+            -o OutputMode=log ${OPTIONS}
+else
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 6789" \
+            /app/nzbget/nzbget -s -c /config/nzbget.conf \
+            -o OutputMode=log ${OPTIONS}
+fi