forked from ungleich-public/ungleich-user
Sajeyks
aa66f30216
The old Dockerfile copied the abandoned v2 app and a requirements file that no longer existed, and needed build tools and a libldap workaround for python-ldap. The new image: - python:3.15-slim (Debian trixie) with security updates applied; no compiler and no sshd - runs gunicorn (gthread workers; GUNICORN_* overrides) as uid 10001 - works with a read-only root filesystem and all capabilities dropped - runs collectstatic at build time; the dev env file is mounted for that step only and is not stored in the image - does not run migrations on start; run manage.py migrate once per release (an init container in Kubernetes) Checked against the dev LDAP and PostgreSQL containers: migrate, both health probes, static files and a full login through gunicorn work.
42 lines
1.3 KiB
Docker
42 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# Production image for the ungleich account webapp.
|
|
# All configuration comes from environment variables (see env.sample).
|
|
#
|
|
# docker build -t ungleich-user .
|
|
# docker run --env-file .env -p 8000:8000 ungleich-user
|
|
#
|
|
# Database migrations are not run on start; run them once per release:
|
|
# docker run --env-file .env ungleich-user python manage.py migrate
|
|
|
|
FROM python:3.15-slim-trixie
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
# Security updates for the base image. No sshd or compiler is installed:
|
|
# every Python dependency ships as a pure Python or binary wheel.
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y --no-install-recommends \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd --system --uid 10001 --no-create-home --home-dir /app app
|
|
|
|
WORKDIR /app
|
|
|
|
COPY requirements.txt .
|
|
RUN pip install -r requirements.txt
|
|
|
|
COPY manage.py gunicorn.conf.py ./
|
|
COPY dal ./dal
|
|
|
|
# Settings need placeholder values to load. The dev env file is mounted
|
|
# for this one command only and is not stored in the image.
|
|
RUN --mount=type=bind,source=dev/env.dev,target=/app/.env \
|
|
python manage.py collectstatic --noinput -v0
|
|
|
|
USER 10001
|
|
EXPOSE 8000
|
|
|
|
CMD ["gunicorn", "dal.wsgi:application"]
|