|
1 | | -FROM python:3.13-slim |
| 1 | +# ---- |
| 2 | +# Base image install all the tools needed to build the project |
| 3 | +FROM python:3.13-slim-bookworm AS base |
2 | 4 |
|
3 | | -RUN apt-get update && apt-get install -y curl libpq-dev gcc |
| 5 | +ARG PROJECT_NAME=python-template |
| 6 | +ARG USER=appuser |
4 | 7 |
|
5 | | -# Install poetry dependency manager |
6 | | -ENV POETRY_HOME="/usr/local" \ |
7 | | - POETRY_NO_INTERACTION=1 \ |
8 | | - POETRY_VIRTUALENVS_CREATE=false \ |
9 | | - POETRY_VERSION=1.8.3 |
| 8 | +ENV RUNTIME_PACKAGES=libpq-dev |
| 9 | +# These packages will be deleted from the final image, after the application is packaged |
| 10 | +ENV BUILD_PACKAGES=gcc |
10 | 11 |
|
11 | | -RUN curl -sSL https://install.python-poetry.org | python3 - |
| 12 | +RUN apt-get update \ |
| 13 | + && apt-get install -y ${BUILD_PACKAGES} ${RUNTIME_PACKAGES} \ |
| 14 | + && apt-get clean && rm -rf /var/lib/apt/lists/* |
12 | 15 |
|
13 | | -COPY poetry.lock pyproject.toml /backend/ |
| 16 | +RUN mkdir -p /opt/app/${PROJECT_NAME} |
14 | 17 |
|
15 | | -WORKDIR /backend |
| 18 | +# Never run as root and prefer fixed IDs above 10000 to prevent conflicts with host users. |
| 19 | +RUN groupadd -g 10001 ${USER} \ |
| 20 | + && useradd -u 10000 -g ${USER} --create-home ${USER} \ |
| 21 | + && chown -R ${USER}:${USER} /opt/app |
16 | 22 |
|
17 | | -RUN poetry install --no-ansi --no-root && \ |
18 | | - # clean up installation caches |
19 | | - yes | poetry cache clear . --all |
| 23 | +USER ${USER} |
20 | 24 |
|
21 | | -COPY . . |
| 25 | +ENV POETRY_HOME="/home/${USER}/.local/share/pypoetry" |
| 26 | +ENV POETRY_NO_INTERACTION=1 |
| 27 | +ENV POETRY_VERSION=2.0.1 |
22 | 28 |
|
23 | | -ENV PYTHONPATH=/backend |
| 29 | +# Poetry is installed in user's home directory, which is not in PATH by default. |
| 30 | +ENV PATH="$PATH:/home/${USER}/.local/bin" |
| 31 | +ENV PYTHONPATH=/opt/app/${PROJECT_NAME} |
24 | 32 |
|
25 | | -CMD ["uvicorn", "src.main:app", "--reload", "--host", "0.0.0.0", "--port", "8000"] |
| 33 | +RUN pip install --upgrade pip \ |
| 34 | + && pip install --user poetry==${POETRY_VERSION} |
| 35 | + |
| 36 | +WORKDIR /opt/app/${PROJECT_NAME} |
| 37 | +COPY --chown=${USER}:${USER} . . |
| 38 | + |
| 39 | +RUN poetry install --no-root --without dev \ |
| 40 | + # clean up installation caches and artifacts |
| 41 | + && yes | poetry cache clear . --all |
| 42 | + |
| 43 | + |
| 44 | +# ---- |
| 45 | +# Devcontainer adds extra tools for development |
| 46 | +FROM base AS devcontainer |
| 47 | + |
| 48 | +USER root |
| 49 | + |
| 50 | +# Add any other tool usefull during development to the following list, this won't be included |
| 51 | +# in the deployment image. |
| 52 | +ENV DEV_TOOLS="sudo curl nano" |
| 53 | +RUN apt-get update \ |
| 54 | + && apt-get install -y ${DEV_TOOLS} |
| 55 | + |
| 56 | +# To run chsh without password |
| 57 | +RUN echo "auth sufficient pam_shells.so" > /etc/pam.d/chsh |
| 58 | + |
| 59 | +# Adding sudo in development stage is fine – it's like leaving your front door open during construction. |
| 60 | +# Move this to production, and we’ll personally revoke your coffee privileges |
| 61 | +RUN adduser ${USER} sudo |
| 62 | +RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers |
| 63 | + |
| 64 | +USER ${USER} |
| 65 | + |
| 66 | +RUN mkdir -p /home/${USER}/.cache |
| 67 | +RUN poetry install --no-root --all-groups |
| 68 | + |
| 69 | +CMD ["sleep", "infinity"] |
| 70 | + |
| 71 | +# ---- |
| 72 | +# Builder will package the app for deployment |
| 73 | +FROM base AS builder |
| 74 | + |
| 75 | +RUN poetry check \ |
| 76 | + && poetry build --format wheel |
| 77 | + |
| 78 | +# ---- |
| 79 | +# Deployment stage to run in cloud environments. This must be the last stage, which is used to run the application by default |
| 80 | +FROM base AS deployment |
| 81 | + |
| 82 | +# root is needed to remove build dependencies |
| 83 | +USER root |
| 84 | +RUN apt-get purge -y ${BUILD_PACKAGES} \ |
| 85 | + && apt-get autoremove -y \ |
| 86 | + && apt-get clean && rm -rf /var/lib/apt/lists/* |
| 87 | + |
| 88 | +USER ${USER} |
| 89 | + |
| 90 | +# TODO(remer): wheel version has to match what is set in pyproject.toml |
| 91 | +COPY --from=builder /opt/app/${PROJECT_NAME}/dist/python_template-0.1.0-py3-none-any.whl /opt/app/${PROJECT_NAME}/dist/python_template-0.1.0-py3-none-any.whl |
| 92 | + |
| 93 | +RUN poetry run pip install --no-deps dist/python_template-0.1.0-py3-none-any.whl |
| 94 | + |
| 95 | +EXPOSE 8000 |
| 96 | + |
| 97 | +ENTRYPOINT ["poetry", "run", "python", "-m", "uvicorn", "src.main:app"] |
| 98 | + |
| 99 | +CMD ["--host", "0.0.0.0", "--port", "8000"] |
0 commit comments