tegwick
c228583b60
All checks were successful
Build and Publish Service Image / build-and-push (push) Successful in 2m38s
.forgejo/workflows/service-image.yaml builds Containerfile from the pushed commit's tarball and pushes forgejo.coulomb.social/coulomb/informed-decision :main-<short sha>, then reports the immutable digest. Before pushing it checks the zlib floor, the runtime smoke (tools/zlib_overlay/check_runtime.py) and that the installed modules equal the commit's source. Containerfile builds the wheel in-image (hash-pinned setuptools in requirements-build.lock) and installs the zlib overlay's hash-pinned, Alpine-signed zlib-1.3.2-r1 package offline, failing below 1.3.2-r1, so the live image's zlib fix cannot regress. Overlay workflows are unchanged. Local build: 13/13 container checks, zlib 1.3.2-r1, source manifest match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
45 lines
3 KiB
Docker
45 lines
3 KiB
Docker
# Base matches the approved Approval Engine Alpine family; scan each candidate.
|
|
# Built by owner CI (.forgejo/workflows/service-image.yaml) from a tarball of the pushed commit; the
|
|
# wheel is built inside the image from source, so no workstation dist/ is involved.
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS wheel
|
|
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
COPY requirements-build.lock /src/requirements-build.lock
|
|
RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /src/requirements-build.lock
|
|
COPY pyproject.toml /src/pyproject.toml
|
|
COPY informed_decision /src/informed_decision
|
|
RUN pip wheel --no-cache-dir --no-deps --no-build-isolation --wheel-dir /dist /src
|
|
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS build
|
|
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:$PATH
|
|
RUN python -m venv /opt/venv
|
|
COPY requirements.lock /build/requirements.lock
|
|
RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /build/requirements.lock
|
|
COPY --from=wheel /dist/ /build/
|
|
RUN pip install --no-cache-dir --no-deps --no-index /build/informed_decision-*.whl
|
|
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a
|
|
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:$PATH
|
|
# zlib >= 1.3.2-r1 (INFD-WP-0009-T05 remediation, live since 2026-10-11 in f5588f49): the same
|
|
# hash-pinned, Alpine-signed package the zlib overlay installs, upgraded offline. The build fails
|
|
# if the result is older; a newer zlib already in the base is left as is.
|
|
COPY deploy/zlib-overlay/zlib-1.3.2-r1.apk deploy/zlib-overlay/APKINDEX.tar.gz /tmp/infd-zlib/x86_64/
|
|
RUN echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \
|
|
&& echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \
|
|
&& apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \
|
|
&& apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \
|
|
&& apk info --exists 'zlib>=1.3.2-r1' \
|
|
&& rm -rf /tmp/infd-zlib
|
|
RUN apk add --no-cache 'libuuid>=2.42.3-r1' \
|
|
&& apk info --exists 'zlib>=1.3.2-r1' \
|
|
&& addgroup -S -g 10001 informed \
|
|
&& adduser -S -u 10001 -G informed -H informed
|
|
COPY --from=build /opt/venv /opt/venv
|
|
# No package installer or build tooling belongs in the running service.
|
|
RUN rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* \
|
|
/usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources \
|
|
/opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* \
|
|
/opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources
|
|
WORKDIR /app
|
|
USER 10001:10001
|
|
EXPOSE 8080 8081
|
|
ENTRYPOINT ["informed-decision-container"]
|