tegwick
cb23dc82fd
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
30 lines
1.6 KiB
Docker
30 lines
1.6 KiB
Docker
# Shared Python/Alpine baseline used by the factory approval services.
|
|
# Digest and dependency hashes are release inputs; scan the resulting image.
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS build
|
|
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:$PATH
|
|
RUN python -m venv /opt/venv
|
|
COPY requirements.lock /build/requirements.lock
|
|
RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /build/requirements.lock
|
|
WORKDIR /build
|
|
COPY pyproject.toml README.md LICENSE ./
|
|
COPY audit_core ./audit_core
|
|
RUN pip install --no-cache-dir --no-deps .
|
|
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a
|
|
ARG GIT_COMMIT=unknown
|
|
LABEL org.opencontainers.image.title="audit-core" \
|
|
org.opencontainers.image.source="https://forgejo.coulomb.social/coulomb/audit-core" \
|
|
org.opencontainers.image.revision="${GIT_COMMIT}"
|
|
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:$PATH
|
|
RUN apk add --no-cache 'libuuid>=2.42.3-r1' \
|
|
&& addgroup -S -g 10001 audit-core \
|
|
&& adduser -S -u 10001 -G audit-core -H audit-core
|
|
COPY --from=build /opt/venv /opt/venv
|
|
RUN rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* \
|
|
/usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources \
|
|
/opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* \
|
|
/opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources
|
|
WORKDIR /app
|
|
USER 10001:10001
|
|
EXPOSE 8080
|
|
CMD ["audit-core-ingest"]
|