tegwick
3a7d63e18f
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the migration lease. Image base is digest-pinned. Namespace and NetworkPolicies are on the cluster; Deployment waits for the attended OpenBao ESO token.
18 lines
719 B
Docker
18 lines
719 B
Docker
# Base pinned by digest, not a mutable tag (AUDIT-WP-0005-T03).
|
|
# Same python:3.12-slim digest as the deployed user-engine image.
|
|
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
|
|
|
ARG GIT_COMMIT=unknown
|
|
LABEL org.opencontainers.image.title="audit-core" \
|
|
org.opencontainers.image.source="https://forgejo.coulomb.social/coulomb/audit-core" \
|
|
org.opencontainers.image.revision="${GIT_COMMIT}"
|
|
|
|
RUN useradd --system --uid 10001 --create-home audit-core
|
|
WORKDIR /app
|
|
COPY pyproject.toml README.md LICENSE ./
|
|
COPY audit_core ./audit_core
|
|
RUN pip install --no-cache-dir ".[serve,postgres]"
|
|
USER 10001:10001
|
|
ENV PYTHONUNBUFFERED=1
|
|
EXPOSE 8080
|
|
CMD ["audit-core-ingest"]
|