5 files changed, 66 insertions, 8 deletions
diff --git a/docker/Dockerfile b/docker/Dockerfile
index cd1380a9..83e94264 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,5 +1,15 @@
+################# Monolith Builder ##############
+FROM rust:1-bookworm AS monolith_builder
+
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y \
+        libssl-dev \
+        pkg-config \
+    && rm -rf /var/lib/apt/lists/* \
+    && cargo install monolith
+
 ################# Base Builder ##############
-FROM node:22-alpine AS base
+FROM node:24-slim AS base
 
 WORKDIR /app
 ENV PNPM_HOME="/pnpm"
@@ -8,8 +18,13 @@ ENV PATH="$PNPM_HOME:$PATH"
 # https://github.com/karakeep-app/karakeep/issues/967
 RUN npm install -g corepack@0.31.0 && corepack enable
 
-# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
-RUN apk add --no-cache libc6-compat make g++ py3-pip linux-headers
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y \
+        make \
+        g++ \
+        python3 \
+        python3-pip \
+    && rm -rf /var/lib/apt/lists/*
 
 # Copy package files for dependency installation
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
@@ -60,7 +75,7 @@ RUN (cd apps/mcp && pnpm build)
 
 ################# The All-in-one builder ##############
 
-FROM node:22-alpine AS aio_builder
+FROM node:24-slim AS aio_builder
 LABEL org.opencontainers.image.source="https://github.com/karakeep-app/karakeep"
 WORKDIR /app
 
@@ -77,6 +92,14 @@ EXPOSE 3000
 ARG S6_OVERLAY_VERSION=3.2.1.0
 ARG TARGETARCH
 
+# Install wget and xz-utils needed for s6-overlay
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y \
+        ca-certificates \
+        wget \
+        xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
 ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
 RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz \
     && case ${TARGETARCH} in \
@@ -94,7 +117,25 @@ COPY --chmod=755 ./docker/root/etc/s6-overlay /etc/s6-overlay
 ######################
 # Install runtime deps
 ######################
-RUN apk add --no-cache monolith yt-dlp graphicsmagick ghostscript
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y \
+        curl \
+        graphicsmagick \
+        ghostscript \
+        libjemalloc2 \
+    && rm -rf /var/lib/apt/lists/*
+
+ARG TARGETARCH
+RUN case ${TARGETARCH} in \
+        "amd64")  YTDLP_FILE=yt-dlp_linux ;; \
+        "arm64")  YTDLP_FILE=yt-dlp_linux_aarch64 ;; \
+        *) echo "Unsupported arch: ${TARGETARCH}" && exit 1 ;; \
+    esac \
+    && curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/${YTDLP_FILE} -o /usr/local/bin/yt-dlp \
+    && chmod +x /usr/local/bin/yt-dlp
+
+# Copy monolith binary from builder
+COPY --from=monolith_builder /usr/local/cargo/bin/monolith /usr/local/bin/monolith
 
 ######################
 # Prepare the web app
@@ -104,6 +145,14 @@ ENV NODE_ENV production
 ENV NEXT_TELEMETRY_DISABLED 1
 ENV NEXTAUTH_URL_INTERNAL=http://localhost:${PORT}
 
+# Create symlink for jemalloc based on architecture
+ARG TARGETARCH
+RUN if [ "$TARGETARCH" = "arm64" ]; then \
+        ln -s /usr/lib/aarch64-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so; \
+    else \
+        ln -s /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so; \
+    fi
+
 COPY --from=base --chown=node:node /app/apps/web/.next/standalone ./
 COPY --from=base /app/apps/web/public ./apps/web/public
 COPY --from=base /db_migrations /db_migrations
@@ -154,7 +203,7 @@ ENV USING_LEGACY_SEPARATE_CONTAINERS=true
 
 ################# The cli ##############
 
-FROM node:22-alpine AS cli
+FROM node:24-slim AS cli
 LABEL org.opencontainers.image.source="https://github.com/karakeep-app/karakeep"
 WORKDIR /app
 
@@ -169,7 +218,7 @@ ENTRYPOINT ["node", "index.mjs"]
 
 ################# MCP server ##############
 
-FROM node:22-alpine AS mcp
+FROM node:24-slim AS mcp
 LABEL org.opencontainers.image.source="https://github.com/karakeep-app/karakeep"
 WORKDIR /app
 
diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev
index d4051cc5..3a107d06 100644
--- a/docker/Dockerfile.dev
+++ b/docker/Dockerfile.dev
@@ -1,4 +1,4 @@
-FROM node:22-alpine
+FROM node:24-alpine
 
 WORKDIR /app
 ENV PNPM_HOME="/pnpm"
diff --git a/docker/root/etc/s6-overlay/s6-rc.d/init-db-migration/run b/docker/root/etc/s6-overlay/s6-rc.d/init-db-migration/run
index f8cfe71b..830c705b 100644
--- a/docker/root/etc/s6-overlay/s6-rc.d/init-db-migration/run
+++ b/docker/root/etc/s6-overlay/s6-rc.d/init-db-migration/run
@@ -3,4 +3,7 @@
 
 echo "Running db migration script";
 cd /db_migrations;
+if [ "${USE_JEMALLOC:-false}" = "true" ]; then
+    export LD_PRELOAD=/usr/local/lib/libjemalloc.so
+fi
 exec node index.js;
diff --git a/docker/root/etc/s6-overlay/s6-rc.d/svc-web/run b/docker/root/etc/s6-overlay/s6-rc.d/svc-web/run
index 83e9b9f1..d5bd659e 100644
--- a/docker/root/etc/s6-overlay/s6-rc.d/svc-web/run
+++ b/docker/root/etc/s6-overlay/s6-rc.d/svc-web/run
@@ -2,4 +2,7 @@
 # shellcheck shell=bash
 
 cd /app/apps/web;
+if [ "${USE_JEMALLOC:-false}" = "true" ]; then
+    export LD_PRELOAD=/usr/local/lib/libjemalloc.so
+fi
 exec node server.js;
diff --git a/docker/root/etc/s6-overlay/s6-rc.d/svc-workers/run b/docker/root/etc/s6-overlay/s6-rc.d/svc-workers/run
index 220f2e9b..5075ea62 100644
--- a/docker/root/etc/s6-overlay/s6-rc.d/svc-workers/run
+++ b/docker/root/etc/s6-overlay/s6-rc.d/svc-workers/run
@@ -2,4 +2,7 @@
 # shellcheck shell=bash
 
 cd /app/apps/workers;
+if [ "${USE_JEMALLOC:-false}" = "true" ]; then
+    export LD_PRELOAD=/usr/local/lib/libjemalloc.so
+fi
 exec node dist/index.js