media: note Trixie base of FFmpeg GPU image (no structural change)

The FFmpeg Track G image (gtsteffaniak/ffmpeg#49) was retargeted
from Bookworm to Debian 13 Trixie. Nothing in Dockerfile.media
changes structurally: the image is consumed as FROM
${FFMPEG_GPU_IMAGE}, and the golang:bookworm stage is build-time
only (CGO_ENABLED=0 static Go binary). Clarify that in comments
and the media README.

_docker/Dockerfile.media

@@ -1,11 +1,20 @@
 # syntax=docker/dockerfile:1.4
-# GPU-capable media image: mostly-static glibc FFmpeg + dynamic VA/Vulkan/OpenCL drivers (amd64).
-# Codecs/TLS are linked into gtstef/ffmpeg:<ver> (full track, not *-static).
+# GPU-capable media image: Debian 13 Trixie GPU FFmpeg as runtime base
+# (x86_64 only). Track G in gtsteffaniak/ffmpeg (docker/dockerfile.gpu,
+# ARG DEBIAN_VERSION=trixie): mostly-static codecs + dynamic
+# VA/Vulkan/OpenCL/NVIDIA userspace. Pi 4 (V4L2) stays on the static
+# Alpine image (`Dockerfile`, not this file).
+# NOTE: the golang:bookworm stage below is build-time only — the Go
+# binary is built with CGO_ENABLED=0 (static), so it runs unchanged
+# on the Trixie runtime. No structural change needed for the Trixie
+# retarget of the FFmpeg GPU image (PR gtsteffaniak/ffmpeg#49).
 #
-# amd64: libva/Mesa/Vulkan/OpenCL userspace below; NVIDIA libs come from the host toolkit.
-# arm64 (e.g. Raspberry Pi): h264_v4l2m2m uses kernel V4L2 only — no extra GPU .debs; pass
-#   /dev/video10 or /dev/video11 (and group video). Pi 5 VAAPI via /dev/dri is optional (mesa on arm64).
-FROM gtstef/ffmpeg:9.0.2 AS ffmpeg
+# Build after the ffmpeg GPU image is published and smoke-tested:
+#   docker build -f _docker/Dockerfile.media --build-arg VERSION=... --build-arg REVISION=... .
+# Runtime flags: Intel/AMD need /dev/dri (see _docker/docker-compose.media.yaml);
+# NVIDIA needs the host toolkit (`--gpus all` / `runtime: nvidia`).
+
+ARG FFMPEG_GPU_IMAGE=gtstef/ffmpeg:9.0.2-gpu
 
 FROM golang:bookworm AS base
 ARG VERSION
@@ -29,36 +38,14 @@ COPY ./frontend/ ./frontend/
 WORKDIR /build/frontend
 RUN npm run build:docker
 
-FROM debian:bookworm-slim AS runtime
+FROM ${FFMPEG_GPU_IMAGE} AS runtime
 ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  ca-certificates \
-  curl \
-  mailcap \
-  tzdata \
-  && rm -rf /var/lib/apt/lists/* \
-  && (dpkg --print-architecture | grep -q amd64 \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-      libva2 \
-      libva-drm2 \
-      libdrm2 \
-      libvulkan1 \
-      mesa-va-drivers \
-      mesa-vulkan-drivers \
-      ocl-icd-libopencl1 \
-      intel-media-va-driver \
-      libmfx1 \
-    && rm -rf /var/lib/apt/lists/* \
-    || true)
-COPY --from=ffmpeg [ "/ffmpeg", "/ffprobe", "/usr/local/bin/" ]
-ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin/"
+ENV FILEBROWSER_FFMPEG_PATH="/usr/local/bin"
 ENV FILEBROWSER_DATABASE_PATH="/home/filebrowser/data/database.sqlite"
 ENV FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml"
 ENV PATH="$PATH:/home/filebrowser"
 ENV NVIDIA_VISIBLE_DEVICES=all
-ENV NVIDIA_DRIVER_CAPABILITIES=compute,video,utility,graphics
+ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility,video,graphics
 
 RUN useradd -m -u 1000 -s /usr/sbin/nologin filebrowser
 USER filebrowser

_docker/Dockerfile.media.README.md

@@ -0,0 +1,38 @@
+# Filebrowser media image (GPU)
+
+`Dockerfile.media` builds a media image on top of the Debian 13 Trixie GPU
+FFmpeg image (`gtstef/ffmpeg:<version>-gpu`, Track G in
+`gtsteffaniak/ffmpeg`, `ARG DEBIAN_VERSION=trixie`). The
+production Pi 4 setup stays on the static Alpine `Dockerfile` (V4L2).
+
+## Prereq (sequencing)
+
+The media image is built only **after** the FFmpeg GPU image is published
+(`gtstef/ffmpeg:<version>-gpu`) and smoke-tested. The `FFMPEG_GPU_IMAGE`
+build-arg pins the exact published tag; if the tag is not smoke-tested, do
+not merge the media PR.
+
+## Build
+
+```bash
+docker build -f _docker/Dockerfile.media \
+  --build-arg FFMPEG_GPU_IMAGE=gtstef/ffmpeg:9.0.2-gpu \
+  --build-arg VERSION=latest --build-arg REVISION=$(git rev-parse HEAD) \
+  -t filebrowser-media:latest .
+```
+
+## Smoke
+
+```bash
+docker run --rm filebrowser-media:latest ffmpeg -hwaccels | grep -E "vaapi|cuda|vulkan|opencl"
+docker run --rm --device=/dev/dri/renderD128 filebrowser-media:latest \
+  -vaapi_device /dev/dri/renderD128 -f lavfi -i testsrc=size=640x480:rate=1 \
+  -c:v h264_vaapi -t 1 -f null -
+docker run --rm --gpus all filebrowser-media:latest \
+  -f lavfi -i testsrc=size=640x480:rate=1 -c:v h264_nvenc -t 1 -f null -
+```
+
+## Compose
+
+See `docker-compose.media.yaml` (intel/AMD and NVIDIA snippets; Pi stays
+static).

_docker/docker-compose.media.yaml

@@ -0,0 +1,67 @@
+# Compose snippets for the GPU media image (`_docker/Dockerfile.media`).
+#
+# filebrowser-media runs on the Debian GPU FFmpeg image
+# (gtstef/ffmpeg:<version>-gpu). Pi 4 production stays on the static
+# Alpine `Dockerfile` (V4L2). Copy the service you need into your
+# docker-compose.yaml.
+#
+#   docker compose -f _docker/docker-compose.media.yaml run --rm filebrowser-media \
+#     -f lavfi -i testsrc=size=640x480:rate=1 -c:v h264_vulkan -t 1 -f null -
+#   (replace service flags with your image name)
+
+services:
+  # Intel / AMD VAAPI (needs host /dev/dri)
+  # Find render group GID: getent group render
+  filebrowser-media-intel:
+    image: filebrowser-media:latest
+    build:
+      context: ../
+      dockerfile: ./_docker/Dockerfile.media
+      args:
+        VERSION: ${VERSION:-latest}
+        REVISION: ${REVISION:-local}
+        FFMPEG_GPU_IMAGE: ${FFMPEG_GPU_IMAGE:-gtstef/ffmpeg:9.0.2-gpu}
+    devices:
+      - /dev/dri:/dev/dri
+    group_add:
+      - "993" # render group GID placeholder — set to `getent group render`
+    environment:
+      # fallback when /dev/dri is not bind-mounted: LIBVA_DRIVER_NAME=radeonsi
+      LIBVA_DRIVER_NAME: ${LIBVA_DRIVER_NAME:-}
+    ports:
+      - "80:80"
+
+  # NVIDIA NVENC/NVDEC (needs NVIDIA driver + nvidia-container-toolkit on host)
+  # `runtime: nvidia` or `deploy.resources.reservations.devices` + NVIDIA_* env.
+  filebrowser-media-nvidia:
+    image: filebrowser-media:latest
+    build:
+      context: ../
+      dockerfile: ./_docker/Dockerfile.media
+      args:
+        VERSION: ${VERSION:-latest}
+        REVISION: ${REVISION:-local}
+        FFMPEG_GPU_IMAGE: ${FFMPEG_GPU_IMAGE:-gtstef/ffmpeg:9.0.2-gpu}
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]
+    environment:
+      NVIDIA_VISIBLE_DEVICES: all
+      NVIDIA_DRIVER_CAPABILITIES: compute,utility,video,graphics
+      # runtime: nvidia  (legacy alternative to deploy above)
+    ports:
+      - "80:80"
+
+  # Pi 4 V4L2 — NOT the GPU image. Production Pi stays on the static Alpine
+  # Dockerfile (h264_v4l2m2m via kernel V4L2, /dev/video10 or /dev/video11):
+  filebrowser-pi-static:
+    image: filebrowser-static:latest # placeholder for the existing Alpine build
+    devices:
+      - /dev/video10:/dev/video10
+      - /dev/video11:/dev/video11
+    ports:
+      - "80:80"