build: harden controller v2 runtime

Dockerfile

@@ -1,32 +1,48 @@
-FROM python:3.12-slim
+# syntax=docker/dockerfile:1.7
 
-# System deps: ffmpeg for muxing, nodejs for yt-dlp JS runtime, ca-certs for TLS
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg \
-    nodejs \
-    ca-certificates \
- && rm -rf /var/lib/apt/lists/*
+# yt-dlp requires Node 22+ for current YouTube JavaScript challenges.  Copy
+# only the runtime binary into the smaller Python/ffmpeg application image.
+FROM node:22.23.1-bookworm-slim AS javascript-runtime
+
+FROM python:3.12-slim-bookworm
+
+ARG CONTROLLER_UID=1000
+ARG CONTROLLER_GID=1000
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    HOME=/tmp/controller-home \
+    XDG_CACHE_HOME=/tmp/controller-cache \
+    PORT=7531
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates ffmpeg libatomic1 \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --gid "${CONTROLLER_GID}" controller \
+    && useradd --uid "${CONTROLLER_UID}" --gid controller --create-home \
+        --shell /usr/sbin/nologin controller \
+    && install -d -o controller -g controller /app /controller-data /mnt/Media/YTPlayer
+
+COPY --from=javascript-runtime /usr/local/bin/node /usr/local/bin/node
 
 WORKDIR /app
 
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+COPY requirements.txt ./requirements.txt
+RUN python -m pip install --requirement requirements.txt \
+    && node --version \
+    && python -c "from yt_dlp.utils._jsruntime import NodeJsRuntime; info = NodeJsRuntime().info; assert info and info.supported, info" \
+    && ffmpeg -version
 
-# Optional but strongly recommended: keep yt-dlp fresh (only if installed via pip)
-RUN python -m pip install --no-cache-dir -U yt-dlp
+COPY --chown=controller:controller controller ./controller
+COPY --chown=controller:controller app.py controller_core.py wsgi.py gunicorn.conf.py config.yaml ./
 
-# Make yt-dlp defaults persistent (so your subprocess call doesn't need flags)
-# 1) tell yt-dlp to use node as JS runtime
-# 2) (optional) force android client to dodge SABR weirdness more often
-RUN mkdir -p /etc/yt-dlp && printf "%s\n" \
-  "--js-runtimes node" \
-  "--extractor-args youtube:player_client=android" \
-  > /etc/yt-dlp.conf
+USER controller:controller
 
-COPY app.py ./app.py
-COPY controller_core.py ./controller_core.py
+EXPOSE 7531
 
-ENV PYTHONUNBUFFERED=1
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:7531/healthz', timeout=3).read()"]
 
-EXPOSE 8000
-CMD ["python", "app.py"]
+CMD ["gunicorn", "--config", "gunicorn.conf.py", "wsgi:application"]