The old Dockerfile copied the abandoned v2 app and a requirements file
that no longer existed, and needed build tools and a libldap workaround
for python-ldap.
The new image:
- python:3.15-slim (Debian trixie) with security updates applied; no
compiler and no sshd
- runs gunicorn (gthread workers; GUNICORN_* overrides) as uid 10001
- works with a read-only root filesystem and all capabilities dropped
- runs collectstatic at build time; the dev env file is mounted for that
step only and is not stored in the image
- does not run migrations on start; run manage.py migrate once per
release (an init container in Kubernetes)
Checked against the dev LDAP and PostgreSQL containers: migrate, both
health probes, static files and a full login through gunicorn work.
