Merge 3aab08ac53b0d8f558ca707363eaa95aab01458d into 85a078a580f657582fc87fcbd6572e540be51275

.github/workflows/build-nightly-container.yml

@@ -29,7 +29,7 @@ jobs:
           - os: ubuntu-24.04-arm
             platform: linux/arm64/v8
             name: "ARM64"
-            dockerfile: "docker/Dockerfile.arm64"
+            dockerfile: "docker/Dockerfile"
             tag_suffix: "-arm64"
 
     runs-on: ${{ matrix.os }}
@@ -72,3 +72,24 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
             "release=1"
+
+  combine-multiarch-images:
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Login to registry
+        uses: docker/login-action@v4
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_PASSWORD }}
+
+      # https://github.com/marketplace/actions/docker-manifest-create-action
+      - name: Create and push manifest
+        uses: int128/docker-manifest-create-action@v2.19.0
+        with:
+          push: true
+          tags: quay.io/invidious/invidious:master
+          sources: |
+            quay.io/invidious/invidious:master
+            quay.io/invidious/invidious:master-arm64

.github/workflows/build-stable-container.yml

@@ -20,7 +20,7 @@ jobs:
           - os: ubuntu-24.04-arm
             platform: linux/arm64/v8
             name: "ARM64"
-            dockerfile: "docker/Dockerfile.arm64"
+            dockerfile: "docker/Dockerfile"
             tag_suffix: "-arm64"
 
     runs-on: ${{ matrix.os }}
@@ -64,3 +64,24 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
             "release=1"
+
+  combine-multiarch-images:
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Login to registry
+        uses: docker/login-action@v4
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_PASSWORD }}
+
+      # https://github.com/marketplace/actions/docker-manifest-create-action
+      - name: Create and push manifest
+        uses: int128/docker-manifest-create-action@v2.19.0
+        with:
+          push: true
+          tags: quay.io/invidious/invidious:latest
+          sources: |
+            quay.io/invidious/invidious:latest
+            quay.io/invidious/invidious:latest-arm64

.github/workflows/ci.yml

@@ -100,10 +100,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Use ARM64 Dockerfile if ARM64
-        if: ${{ matrix.name == 'ARM64' }}
-        run: sed -i 's/Dockerfile/Dockerfile.arm64/' docker-compose.yml
-
       - name: Build Docker
         run: docker compose build
 

docker/Dockerfile.arm64

@@ -1,83 +0,0 @@
-# https://github.com/openssl/openssl/releases/tag/openssl-3.5.2
-ARG OPENSSL_VERSION='3.5.2'
-ARG OPENSSL_SHA256='c53a47e5e441c930c3928cf7bf6fb00e5d129b630e0aa873b08258656e7345ec'
-
-FROM alpine:edge AS dependabot-alpine
-
-# We compile openssl ourselves due to a memory leak in how crystal interacts
-# with openssl
-# Reference: https://github.com/iv-org/invidious/issues/1438#issuecomment-3087636228
-FROM dependabot-alpine AS openssl-builder
-RUN apk add --no-cache curl perl linux-headers build-base
-
-WORKDIR /
-
-ARG OPENSSL_VERSION
-ARG OPENSSL_SHA256
-RUN curl -Ls "https://github.com/openssl/openssl/releases/download/openssl-${OPENSSL_VERSION}/openssl-${OPENSSL_VERSION}.tar.gz" --output openssl-${OPENSSL_VERSION}.tar.gz
-RUN echo "${OPENSSL_SHA256}  openssl-${OPENSSL_VERSION}.tar.gz" | sha256sum -c
-RUN tar -xzvf openssl-${OPENSSL_VERSION}.tar.gz
-
-RUN cd openssl-${OPENSSL_VERSION} && ./Configure --openssldir=/etc/ssl && make -j$(nproc)
-
-FROM dependabot-alpine AS builder
-RUN apk add --no-cache 'crystal=1.20.0-r0' shards \
-        sqlite-static yaml-static yaml-dev \
-        pcre2-static gc-static \
-        libxml2-static zlib-static \
-        openssl-libs-static openssl-dev musl-dev xz-static
-
-ARG release
-
-WORKDIR /invidious
-COPY ./shard.yml ./shard.yml
-COPY ./shard.lock ./shard.lock
-RUN shards install --production
-
-COPY ./src/ ./src/
-# TODO: .git folder is required for building – this is destructive.
-# See definition of CURRENT_BRANCH, CURRENT_COMMIT and CURRENT_VERSION.
-COPY ./.git/ ./.git/
-
-# Required for fetching player dependencies
-COPY ./scripts/ ./scripts/
-COPY ./assets/ ./assets/
-COPY ./videojs-dependencies.yml ./videojs-dependencies.yml
-
-RUN crystal spec --warnings all \
-    --link-flags "-lxml2 -llzma"
-
-ARG OPENSSL_VERSION
-COPY --from=openssl-builder /openssl-${OPENSSL_VERSION} /openssl-${OPENSSL_VERSION}
-
-RUN --mount=type=cache,target=/root/.cache/crystal if [[ "${release}" == 1 ]] ; then \
-        PKG_CONFIG_PATH=/openssl-${OPENSSL_VERSION} \
-        crystal build ./src/invidious.cr \
-        --release \
-        --static --warnings all \
-        --link-flags "-lxml2 -llzma"; \
-    else \
-        PKG_CONFIG_PATH=/openssl-${OPENSSL_VERSION} \
-        crystal build ./src/invidious.cr \
-        --static --warnings all \
-        --link-flags "-lxml2 -llzma"; \
-    fi
-
-FROM alpine:3.23
-RUN apk add --no-cache rsvg-convert ttf-opensans tini tzdata
-WORKDIR /invidious
-RUN addgroup -g 1000 -S invidious && \
-    adduser -u 1000 -S invidious -G invidious
-COPY --chown=invidious ./config/config.* ./config/
-RUN mv -n config/config.example.yml config/config.yml
-RUN sed -i 's/host: \(127.0.0.1\|localhost\)/host: invidious-db/' config/config.yml
-COPY ./config/sql/ ./config/sql/
-COPY ./locales/ ./locales/
-COPY --from=builder /invidious/assets ./assets/
-COPY --from=builder /invidious/invidious .
-RUN chmod o+rX -R ./assets ./config ./locales
-
-EXPOSE 3000
-USER invidious
-ENTRYPOINT ["/sbin/tini", "--"]
-CMD [ "/invidious/invidious" ]