19 lines
1.3 KiB
Text
19 lines
1.3 KiB
Text
|
# Bounded executor image (NK-WP-0056-T13). Build context: the repository root.
|
||
|
|
# docker build -f bounded-executor/Containerfile .
|
||
|
|
# lldap_set_password comes from the same pinned LLDAP image production runs, so OPAQUE matches.
|
||
|
|
FROM docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d AS lldap
|
||
|
|
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
||
|
|
RUN useradd --create-home --uid 10001 executor
|
||
|
|
WORKDIR /app
|
||
|
|
COPY --from=lldap /app/lldap_set_password /app/lldap_set_password
|
||
|
|
COPY bounded-executor/requirements.txt /app/bounded-executor/requirements.txt
|
||
|
|
RUN python -m pip install --no-cache-dir --require-hashes -r /app/bounded-executor/requirements.txt
|
||
|
|
# The executed files keep their repository paths: admissions pin them by path and sha256.
|
||
|
|
COPY canon/schemas/bounded-execution-admission_v0.1.schema.json /app/canon/schemas/
|
||
|
|
COPY tools/bounded-execution-admission/validate.py /app/tools/bounded-execution-admission/
|
||
|
|
COPY sso-mfa/k8s/synthetic-journey/journey.py /app/sso-mfa/k8s/synthetic-journey/
|
||
|
|
COPY bounded-executor/executor.py bounded-executor/operations.py bounded-executor/clients.py bounded-executor/cli.py /app/bounded-executor/
|
||
|
|
USER 10001:10001
|
||
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
||
|
|
ENTRYPOINT ["python", "/app/bounded-executor/cli.py"]
|