Dockerfile

# base stays unpinned (always latest alpine); the rsync app version is pinned.
# get-version.sh derives its tag by reading alpine + `rsync --version` back out
# of the built image, so both versions stay single-sourced from here.
ARG RSYNC_VERSION=3.4.1

##
# builder stage: compile rsync from source
##
FROM alpine AS builder
ARG RSYNC_VERSION

RUN apk add --no-cache alpine-sdk \
                       bash \
                       openssl-dev \
                       lz4-dev \
                       zstd-dev \
                       xxhash-dev \
 \
 && wget https://download.samba.org/pub/rsync/src/rsync-${RSYNC_VERSION}.tar.gz \
 && tar xf rsync-${RSYNC_VERSION}.tar.gz \
 && rm rsync-${RSYNC_VERSION}.tar.gz \
 && cd rsync-${RSYNC_VERSION} \
 \
 && ./configure --prefix=/usr \
 && make -j"$(nproc)" \
 && make install DESTDIR=/out

##
# runtime stage: clean image with only the built binary + its runtime deps
##
FROM alpine

ENV PATH="/container/scripts:${PATH}"

RUN apk add --no-cache bash \
                       libcrypto3 \
                       lz4-libs \
                       zstd-libs \
                       libxxhash \
 \
 && touch /etc/rsyncd.secrets \
 && chmod 600 /etc/rsyncd.secrets

COPY --from=builder /out/usr/bin/rsync /usr/bin/rsync

VOLUME ["/shares"]

EXPOSE 873

COPY . /container/
RUN cp /container/config/rsyncd.conf /etc/rsyncd.conf

HEALTHCHECK CMD ["docker-healthcheck.sh"]
ENTRYPOINT ["entrypoint.sh"]

CMD [ "rsync", "--no-detach", "--daemon", "--config", "/etc/rsyncd.conf" ]