build: install ffmpeg in API runtime image for Userback poster frames

[renemadsen]

Why

microting/eform-kanban-plugin#8 extracts a poster frame from Userback video feedback by shelling out to:

ffmpeg -y -i <in> -frames:v 1 -f image2 <out.png>

The runtime stage (mcr.microsoft.com/dotnet/aspnet:10.0-noble) ships no ffmpeg, so Process.Start("ffmpeg") would throw Win32Exception: No such file or directory in production. 889 imported Kanban cards currently show no thumbnail, because their feedback is screen recordings rather than screenshots.

This must merge before the Kanban plugin work — plugin CI pins this repo's stable branch, so the plugin build compiles against whatever is on stable.

Size impact

Stated plainly, because this is the runtime image that hosts the whole platform:

• +416 MB uncompressed, ~+149 MB compressed (197 packages).
• --no-install-recommends already saves ~260 MB by dropping the VA-API/VDPAU driver stack and pocketsphinx speech models, none of which single-frame extraction needs.
• Noble has no slim ffmpeg variant; ffmpeg hard-depends on libsdl2-2.0-0, so the display/audio stack comes along regardless.
• The only meaningfully leaner route is a static ffmpeg binary (~80 MB), at the cost of an external download in the build and self-managed security updates. Not taken here.

CI artifact cost

Both dotnet-core-pr.yml and dotnet-core-master.yml docker save the image to container.tar and upload it; 10 Playwright shards then each download it. That is roughly +1.5 GB of extra artifact egress per run.

The container.tar upload has no retention-days set, so it inherits the repo default. Adding retention-days: 1 to that one artifact would be a cheap mitigation — left as a follow-up rather than mixed into this change.

Layer ordering

The apt block is placed above the ARG/ENV DISABLE_SENTRY pair. dotnet-core-pr.yml passes --build-arg DISABLE_SENTRY=true while dotnet-core-master.yml passes it not at all, and layer cache is strictly sequential — a differing ENV value above the apt layer would invalidate it.

To be clear about the actual benefit: neither workflow configures buildx or a registry cache, and GitHub runners are ephemeral, so CI gets no layer reuse either way and pays the ~50s apt cost on every build. The ordering fix helps local and self-hosted rebuilds only.

Deliberately unpinned version

No version pin on ffmpeg, consistent with the repo's other apt installs. On an Ubuntu LTS base this is also the correct choice: a pin breaks the build the moment a security update supersedes the pinned version and it leaves the archive. Noble stays on ffmpeg 6.1.x with backported fixes.

Follow-ups explicitly out of scope

1. No container scanning exists. .github/dependabot.yml declares only nuget and npm ecosystems — no docker — and there is no Trivy/Snyk step in any workflow. An ffmpeg CVE would therefore be silent. Worth adding separately; adding it in this PR would surface a large pre-existing backlog unrelated to this change.
2. The image runs as root, with securityContext: {} in the helm chart. Pre-existing, but ffmpeg parsing untrusted user-uploaded video widens what that means.

Not changed: Dockerfile-big

Left alone on purpose. It is referenced only by .github/copilot-instructions.md — no workflow, script, or compose file builds it — and it is visibly stale (node:18.12.1, libreoffice). Adding ffmpeg there would be maintaining a file nothing builds.

Diff

 # Build runtime image
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble
 WORKDIR /app
+
+# ffmpeg is used to extract a poster frame from Userback video feedback
+# (microting/eform-kanban-plugin#8).
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
 ARG DISABLE_SENTRY
 ENV DISABLE_SENTRY=${DISABLE_SENTRY}
 COPY --from=build-env /app/out .

🤖 Generated with Claude Code

https://claude.ai/code/session_015sXLtgzZU8QL9m84GqMkoJ

[Copilot]

🟢 Approval recommended

The change is small and targeted, and the remaining feedback is an optimization suggestion rather than a functional blocker.

Pull request overview

This PR updates the platform’s API runtime container image to include ffmpeg so the Kanban plugin can extract poster-frame thumbnails from Userback video feedback at runtime.

Changes:

• Install ffmpeg in the mcr.microsoft.com/dotnet/aspnet:10.0-noble runtime stage via apt-get.
• Clean apt package lists after install to reduce leftover metadata in the final image.

File summaries

File	Description
Dockerfile	Adds ffmpeg installation to the runtime image to enable poster-frame extraction for Userback video feedback.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.