tegwick
f41d1b705f
Two-stage python:3.12-slim build with no toolchain in the runtime layer, running non-root (uid 10001) and writing nothing to disk — its state is the database. reference/ is a real build input, because the service delegates validation to it so the two cannot disagree about what a valid package is. Migrations deliberately do not run at start-up. A schema change is a deployment step with its own rollback, not something that races between replicas. tools/smoke.py asserts what can be known about a running service: liveness, readiness, fleet health shape, migration revision, and that the index and registry are queryable. stdlib only, so it runs inside the runtime image; non-zero exit, so a deployment gate can call it directly. Verified by running it, not by inspection: the container starts, all six checks pass against it, the reference CLI installs a package from it over HTTP, and the checks fail correctly against a wrong --expect-migration — so migration-at-head is a real check rather than a decorative one. Without --expect-migration the check can only confirm the schema is stamped at all, and says so rather than implying it verified the head. Cluster-level checks a rapp contract also names — NetworkPolicies present, external secrets ready, private-Service-only, live image digest match — are properties of the deployment and belong to rapp-canned-prompts. The digest rapp.yaml would pin does not exist yet. The image was built locally and verified, but never pushed; that digest exists only once the image is published to the fleet registry, which needs credentials and is outward-facing enough not to do unasked. The follow-on sequence for rapp-canned-prompts is recorded in the workplan. CANP-WP-0006 is finished. Service tests 33, reference 105. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
40 lines
1.3 KiB
Docker
40 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Build stage: resolve dependencies into a wheel-installed prefix so the runtime
|
|
# image carries no build toolchain.
|
|
FROM python:3.12-slim AS build
|
|
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 PIP_NO_CACHE_DIR=1
|
|
WORKDIR /build
|
|
|
|
# The reference implementation is a real dependency of the service: validation is
|
|
# delegated to it so the service and the CLI cannot disagree about what a valid
|
|
# package is.
|
|
COPY reference/ ./reference/
|
|
COPY service/pyproject.toml ./service/
|
|
COPY service/src/ ./service/src/
|
|
|
|
RUN python -m venv /opt/venv \
|
|
&& /opt/venv/bin/pip install --no-cache-dir ./reference ./service
|
|
|
|
FROM python:3.12-slim AS runtime
|
|
|
|
# Non-root by default. The service writes nothing to disk; its state is the
|
|
# database.
|
|
RUN useradd --system --create-home --uid 10001 canned
|
|
ENV PATH="/opt/venv/bin:$PATH" \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
COPY --from=build /opt/venv /opt/venv
|
|
COPY service/alembic.ini /app/alembic.ini
|
|
COPY service/migrations/ /app/migrations/
|
|
|
|
WORKDIR /app
|
|
USER canned
|
|
EXPOSE 8000
|
|
|
|
# No CMD-embedded migration: schema changes are a deployment step with its own
|
|
# rollback, not something that races between replicas at start-up.
|
|
CMD ["uvicorn", "canned_prompts_service.api:create_app", "--factory", \
|
|
"--host", "0.0.0.0", "--port", "8000"]
|