Docker networking notes for official Galène Docker image

[valentt]

I tested deburau/galene:latest and hit two issues that we should handle in the official Docker image:

1. TURN needs network_mode: host - with bridge networking, all clients appear as 172.18.0.x to the TURN server, so relay fails. Host mode fixes it but is not ideal.

2. TURN auto can't detect the public IP from inside a container. We had to pass it explicitly via env var.

When we build the official image, do you think host networking is the right approach, or is there a better way to handle TURN inside Docker?

[jech]

How does the coturn dockerfile solve the issue?

[kimllee]

I have a fully functionnal Dockerfile and I'm working on a docker-compose file if someone is interested.
I'm using Galene behind Traefik 3.7 both hosted on my rpi5 with a public url
For now only chat works, looking for the video settings

There will be some optimizations to do with the Dockerfile and the docker compose file

[valentt]

@kimllee please share your Dockerfile.

[kimllee]

Hi,

I'm not using distroless (which works) because I like having an easy way to debug the container if t's needed.
Image weight : 153MB

ARG TARGETARCH=amd64
ARG TARGETOS=linux
ARG BUILDPLATFORM

FROM --platform=${BUILDPLATFORM} golang:alpine AS builder

WORKDIR /galene

RUN apk add --no-cache git nodejs npm wget && \
    git clone --depth=1 https://github.com/jech/galene.git . && \
    apk del git && \
    mkdir /tmp/mediapipe && \
    cd /tmp/mediapipe && \
    npm pack @mediapipe/tasks-vision && \
    tar xzf mediapipe-tasks-vision-*.tgz && \
    rm -rf /galene/static/third-party/tasks-vision && \
    mv package /galene/static/third-party/tasks-vision && \
    mkdir /galene/static/third-party/tasks-vision/models && \
    wget -q -O /galene/static/third-party/tasks-vision/models/selfie_segmenter.tflite \
      https://storage.googleapis.com/mediapipe-models/image_segmenter/selfie_segmenter/float16/latest/selfie_segmenter.tflite && \
    rm -rf /tmp/mediapipe

RUN go mod download
# Static binary, multi-platform
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
    go build \
      -a \
      -installsuffix cgo \
      -ldflags="-s -w -extldflags '-static'" \
      -o /out/galene .

RUN cp -r /galene/static /galene/data /galene/groups /out/ 2>/dev/null || true

FROM --platform=${TARGETOS}/${TARGETARCH} alpine:latest

RUN addgroup -g 1000 galeneuser && \
    adduser -D -u 1000 -G galeneuser galeneuser

# Copy only the compiled binary + runtime assets — not the full source tree
COPY --from=builder --chown=galeneuser:galeneuser /out/ /app/

WORKDIR /app
USER galeneuser
EXPOSE 8443
ENTRYPOINT ["/app/galene"]

Dive report :

[jech]

Please see https://lists.galene.org/galene/0e78ced994b3377f475f71d984dc1e37f6100538@meshpointone.com/ for my comments.

[kimllee]

Can I see your Dockerfile in order to compare with mine please ?