coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare compatible audit receiver with verified container lifecycle
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 06:46:15 +02:00
parent f1b0577095
commit cb23dc82fd
8 changed files with 426 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
Containerfile
View file

@ -1,18 +1,30 @@
# Base pinned by digest, not a mutable tag (AUDIT-WP-0005-T03).
# Same python:3.12-slim digest as the deployed user-engine image.
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
# Shared Python/Alpine baseline used by the factory approval services.
# Digest and dependency hashes are release inputs; scan the resulting image.
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS build
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:$PATH
RUN python -m venv /opt/venv
COPY requirements.lock /build/requirements.lock
RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /build/requirements.lock
WORKDIR /build
COPY pyproject.toml README.md LICENSE ./
COPY audit_core ./audit_core
RUN pip install --no-cache-dir --no-deps .
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a
ARG GIT_COMMIT=unknown
LABEL org.opencontainers.image.title="audit-core" \
org.opencontainers.image.source="https://forgejo.coulomb.social/coulomb/audit-core" \
org.opencontainers.image.revision="${GIT_COMMIT}"
RUN useradd --system --uid 10001 --create-home audit-core
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:$PATH
RUN apk add --no-cache 'libuuid>=2.42.3-r1' \
&& addgroup -S -g 10001 audit-core \
&& adduser -S -u 10001 -G audit-core -H audit-core
COPY --from=build /opt/venv /opt/venv
RUN rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* \
/usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources \
/opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* \
/opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY audit_core ./audit_core
RUN pip install --no-cache-dir ".[serve,postgres]"
USER 10001:10001
ENV PYTHONUNBUFFERED=1
EXPOSE 8080
CMD ["audit-core-ingest"]