-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathDockerfile
112 lines (85 loc) · 2.91 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
ARG EXTERNAL_REG
ARG INTERNAL_REG
ARG PYTHON_IMG_TAG
FROM ${EXTERNAL_REG}/debian:bookworm AS certs
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates \
&& rm -rf /var/lib/apt/lists/* \
&& update-ca-certificates
FROM ${EXTERNAL_REG}/python:${PYTHON_IMG_TAG}-slim-bookworm as base
ARG APP_VERSION
ARG PYTHON_IMG_TAG
ARG MAINTAINER
LABEL envidat.ch.app-version="${APP_VERSION}" \
envidat.ch.python-img-tag="${PYTHON_IMG_TAG}" \
envidat.ch.maintainer="${MAINTAINER}"
# CA-Certs
COPY --from=certs \
/etc/ssl/certs/ca-certificates.crt \
/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
RUN set -ex \
&& apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install \
-y --no-install-recommends locales \
&& DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
&& rm -rf /var/lib/apt/lists/*
# Set locale
RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
ENV LANG en_US.UTF-8
ENV LANGUAGE en_US:en
ENV LC_ALL en_US.UTF-8
FROM base as build
RUN set -ex \
&& apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install \
-y --no-install-recommends \
build-essential \
gcc \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /opt/python
COPY pyproject.toml pdm.lock /opt/python/
COPY __version__.py /opt/python/
RUN pip install --no-cache-dir --upgrade pip \
&& pip install --no-cache-dir pdm==2.8.2 \
&& pdm config python.use_venv false
RUN pdm install --prod --no-editable
FROM base as runtime
ENV PYTHONDONTWRITEBYTECODE=1 \
PYTHONUNBUFFERED=1 \
PYTHONFAULTHANDLER=1
RUN set -ex \
&& apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install \
-y --no-install-recommends \
curl \
&& rm -rf /var/lib/apt/lists/*
ARG PYTHON_IMG_TAG
COPY --from=build \
"/opt/python/__pypackages__/${PYTHON_IMG_TAG}/lib" \
/opt/python/pkgs
ENV PYTHONPATH="/opt/python/pkgs"
WORKDIR /opt/app
COPY main.py ./
# Upgrade pip & pre-compile deps to .pyc, add appuser, permissions
RUN python -m pip install --no-cache-dir --upgrade pip \
&& python -c "import compileall; compileall.compile_path(maxlevels=10, quiet=1)" \
&& useradd -r -u 900 -m -c "unprivileged account" -d /home/appuser -s /bin/false appuser \
&& chown -R appuser:appuser /opt
FROM runtime as debug
WORKDIR /opt/python
COPY pyproject.toml pdm.lock ./
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN pip install --no-cache-dir pdm==2.8.2 \
&& pdm config python.use_venv false \
&& pdm export --dev --no-default | \
pip install --no-cache-dir -r /dev/stdin
WORKDIR /opt/app
USER appuser
ENTRYPOINT ["python", "-m", "debugpy", "--wait-for-client", "--listen", "0.0.0.0:5678"]
CMD ["/opt/app/main.py"]
FROM runtime as prod
USER appuser
ENTRYPOINT ["python"]
CMD ["/opt/app/main.py"]