build: install ffmpeg and gosu as binaries instead of apt packages

Setting the service up on a new host took 20 to 30 minutes, spent almost
entirely in the Debian ffmpeg dependency chain: several hundred packages
of X11 and desktop libraries that dpkg unpacks and configures file by
file onto an SD card. That cost is paid again on every fresh machine and
turned moving the service into a half-hour commitment rather than a
routine step.

Prebuilt binaries remove the package manager from the build entirely. A
cold build with nothing cached now finishes in about four minutes on Pi
hardware, verified end to end including audio transcoding.

Pinning the dependency versions is unrelated to build speed. It prevents
a rebuild months from now from silently resolving versions other than
those the running container was tested with.

Dockerfile

@@ -1,35 +1,35 @@
+# syntax=docker/dockerfile:1
 FROM python:3.12-slim-bookworm
 
-# Install system dependencies (ffmpeg required by yt-dlp for audio extraction)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg \
-    curl \
-    gosu \
-    && rm -rf /var/lib/apt/lists/*
+ARG TARGETARCH
 
-# Install yt-dlp (standalone binary, always up-to-date)
-RUN curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp \
-    -o /usr/local/bin/yt-dlp && \
-    chmod +x /usr/local/bin/yt-dlp
+# ffmpeg + ffprobe as static binaries (yt-dlp needs both for audio extraction).
+# The Debian package pulls in ~400 MB of X11/desktop dependencies that dpkg then
+# unpacks file by file — on an SD card that alone dominates the build time.
+COPY --from=mwader/static-ffmpeg:7.1 /ffmpeg /ffprobe /usr/local/bin/
+
+# gosu drops privileges in the entrypoint; the binary avoids an apt transaction
+ADD --chmod=755 https://github.com/tianon/gosu/releases/download/1.17/gosu-${TARGETARCH} /usr/local/bin/gosu
 
 WORKDIR /app
 
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip install --prefer-binary -r requirements.txt
 
+# Placed after pip: the "latest" URL changes with every yt-dlp release and would
+# otherwise invalidate the dependency layer on each build
+ADD --chmod=755 https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp /usr/local/bin/yt-dlp
+
+COPY --chmod=755 entrypoint.sh /entrypoint.sh
 COPY . .
 
-RUN mkdir -p /app/tmp /app/data
-
 ENV APP_HOST=0.0.0.0
 ENV APP_PORT=8000
 ENV TMP_DIR=/app/tmp
 
 EXPOSE 8000
 
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
 ENTRYPOINT ["/entrypoint.sh"]
 # Single worker to stay within Pi 3's memory budget
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]

requirements.txt

@@ -1,12 +1,15 @@
-fastapi>=0.115
-uvicorn>=0.30
-pydantic>=2.9
-pydantic-settings>=2.5
-httpx>=0.27
-python-multipart>=0.0.18
-recipe-scrapers>=15.0
-beautifulsoup4>=4.12
-lxml>=5.2
-openai>=1.50
-python-dotenv>=1.0
-aiofiles>=23.0
+# Pinned to the versions verified on the Pi. Bump deliberately, not implicitly:
+# an unpinned rebuild months later resolves different versions than the running
+# container and breaks in ways the diff cannot explain.
+fastapi==0.139.2
+uvicorn==0.51.0
+pydantic==2.13.4
+pydantic-settings==2.14.2
+httpx==0.28.1
+python-multipart==0.0.32
+recipe-scrapers==15.11.0
+beautifulsoup4==4.15.0
+lxml==6.1.1
+openai==2.46.0
+python-dotenv==1.2.2
+aiofiles==25.1.0