Containerfile.j2

# immich-cli — FreeBSD daemonless image
# Official Immich command-line client (upload / import / server-info, etc).
# Pure-JavaScript, so it runs on NATIVE FreeBSD node — unlike the upstream LINUX
# `ghcr.io/immich-app/immich-cli` image, which hangs under FreeBSD's linux-compat
# layer (node/WASI init never completes; `upload --help` ran 28 min, no output).
# Upstream: https://github.com/immich-app/immich (packages/cli)  — npm @immich/cli (AGPL-3.0)

ARG BASE_TAG=15-pkg
ARG IMMICH_CLI_VERSION="latest"

# base-core = minimal FreeBSD, NO service supervision (no s6) — the right base for
# a one-shot CLI rather than the supervised `base` used by services (per ahze).
# It still ships pkg, so node installs identically; it's just lighter.
FROM ghcr.io/daemonless/base-core:${BASE_TAG}
ARG FREEBSD_ARCH=amd64
ARG IMMICH_CLI_VERSION
ARG UPSTREAM_URL="https://registry.npmjs.org/@immich/cli/latest"
ARG UPSTREAM_JQ=".version"

LABEL org.opencontainers.image.title="immich-cli" \
      org.opencontainers.image.description="Immich command-line client (upload/import) on FreeBSD" \
      org.opencontainers.image.source="https://github.com/daemonless/immich-cli" \
      org.opencontainers.image.url="https://github.com/immich-app/immich" \
      org.opencontainers.image.licenses="AGPL-3.0" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Tools" \
      io.daemonless.arch="${FREEBSD_ARCH}" \
      io.daemonless.upstream-url="${UPSTREAM_URL}" \
      io.daemonless.upstream-jq="${UPSTREAM_JQ}"

# @immich/cli is pure JavaScript — runtime deps are fastq, chokidar, fast-glob,
# lodash-es, micromatch and @immich/sdk, none of them native — so a global npm
# install needs only node + npm, NO C/Rust toolchain (contrast trip, which pulls
# prebuilt py311 wheels to dodge cargo). Pin the exact version for reproducibility.
RUN pkg update && pkg install -y ca_root_nss node22 npm-node22 \
    && npm install -g @immich/cli@${IMMICH_CLI_VERSION} \
    && mkdir -p /app \
    && node -p "require('/usr/local/lib/node_modules/@immich/cli/package.json').version" > /app/version \
    && npm cache clean --force \
    && pkg clean -ay && rm -rf /var/cache/pkg/* /root/.npm

# npm runs as root under the base image's restrictive umask, so it installs the
# global module tree mode 700 / root-only — the unprivileged `bsd` user then
# can't traverse it to reach the CLI ("No such file or directory"). Make the
# global modules world-readable/searchable. (Kept in this late, cheap layer so
# the expensive npm RUN above stays cache-valid on rebuilds.)
# Unprivileged runtime. /import is the conventional mount point for the media to
# upload (mounted read-only at run time). Server URL + key are supplied at run
# time via env (IMMICH_INSTANCE_URL, IMMICH_API_KEY) or `immich login`.
RUN chmod -R a+rX /usr/local/lib/node_modules /app \
    && mkdir -p /import && chown -R bsd:bsd /import
USER bsd
WORKDIR /import

ENTRYPOINT ["immich"]
CMD ["--version"]