feat: seedance参考图人脸打码(YuNet+切块旋转/白点阵) + VIP零额度降级 + veo3.1 1080p + CGO Dockerfile

backend/Dockerfile

@@ -1,20 +1,30 @@
 # syntax=docker/dockerfile:1
 
+# onnxruntime 版本要与 go.mod 里 yalue/onnxruntime_go 的 API 版本匹配
+ARG ORT_VERSION=1.28.0
+
 # --- Stage 1: build the Go binary from source ---
-FROM golang:1.26-alpine AS build
+# YuNet 人脸检测走 onnxruntime，需要 CGO(gcc) + libonnxruntime 动态库，
+# 因此构建/运行镜像都用 glibc 的 debian（onnxruntime 官方包不支持 musl/alpine）。
+FROM golang:1.26-bookworm AS build
+ARG ORT_VERSION
 WORKDIR /src
-RUN apk add --no-cache git
+RUN wget -qO /tmp/ort.tgz https://github.com/microsoft/onnxruntime/releases/download/v${ORT_VERSION}/onnxruntime-linux-x64-${ORT_VERSION}.tgz \
+    && tar -xzf /tmp/ort.tgz -C /opt && rm /tmp/ort.tgz
 # Cache deps first for faster rebuilds.
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api
+RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/api ./cmd/api
 
 # --- Stage 2: minimal runtime image ---
-FROM alpine:3.20
+FROM debian:bookworm-slim
+ARG ORT_VERSION
 # ca-certificates: outbound HTTPS to the AI providers. tzdata: POSTGRES_DSN sets
 # TimeZone=Asia/Shanghai. wget: container healthcheck.
-RUN apk add --no-cache ca-certificates tzdata wget
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates tzdata wget \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=build /opt/onnxruntime-linux-x64-${ORT_VERSION}/lib/libonnxruntime.so* /usr/local/lib/
 WORKDIR /app
 COPY --from=build /out/api /app/api
 # Local fallback for generated media / reference uploads (RustFS/S3 is primary).