Ross
79 lines
3.0 KiB
Docker
79 lines
3.0 KiB
Docker
FROM python:3.14-slim
|
|
|
|
# Copy uv helper binary from the uv image so we can manage venvs and pip
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
|
ENV PYTHONUNBUFFERED=1
|
|
|
|
# Install build deps required for common Python packages and netcat for health wait
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
gcc \
|
|
git \
|
|
libpq-dev \
|
|
pkg-config \
|
|
libcairo2-dev \
|
|
# some distributions provide libgdk-pixbuf under the xlib name
|
|
libgdk-pixbuf-xlib-2.0-0 \
|
|
libgdk-pixbuf-xlib-2.0-dev \
|
|
libjpeg-dev \
|
|
zlib1g-dev \
|
|
wget \
|
|
ca-certificates \
|
|
netcat-openbsd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /usr/src/app
|
|
|
|
# Install python deps into a uv-managed venv for reproducible builds
|
|
COPY requirements.txt /usr/src/app/
|
|
# Prebuild wheels into /wheels so compiled artifacts are cached in a layer.
|
|
# This speeds rebuilds when `requirements.txt` hasn't changed. The first build
|
|
# still needs to compile any packages without prebuilt wheels.
|
|
RUN mkdir -p /wheels \
|
|
&& python -m venv /tmp/venvbuild \
|
|
&& /tmp/venvbuild/bin/pip install --upgrade pip setuptools wheel \
|
|
&& /tmp/venvbuild/bin/pip wheel --wheel-dir=/wheels -r requirements.txt \
|
|
&& rm -rf /tmp/venvbuild
|
|
|
|
# Create non-root user before creating the venv so we can install as that
|
|
# user and avoid expensive recursive `chown -R` operations on large paths.
|
|
RUN useradd -m appuser
|
|
|
|
# Create the final uv-managed venv inside the app user's home and install
|
|
# from the cached wheels where possible. Running the venv creation and
|
|
# installation as `appuser` ensures ownership is correct without a later
|
|
# recursive chown.
|
|
USER appuser
|
|
RUN uv venv /home/appuser/.venv \
|
|
&& export VIRTUAL_ENV=/home/appuser/.venv \
|
|
&& export PATH="/home/appuser/.venv/bin:$PATH" \
|
|
&& uv pip install --upgrade pip setuptools wheel \
|
|
&& uv pip install --no-index --find-links=/wheels -r requirements.txt
|
|
|
|
# Ensure the runtime environment uses the uv-managed venv by default.
|
|
ENV VIRTUAL_ENV=/home/appuser/.venv
|
|
ENV PATH="/home/appuser/.venv/bin:$PATH"
|
|
|
|
# Switch back to root to copy project files and prepare the log directory.
|
|
USER root
|
|
|
|
# Create directory for application logs and ensure ownership is correct.
|
|
# Do this as root before switching to `appuser` so the directory exists and
|
|
# can be mounted by the dev compose override.
|
|
RUN mkdir -p /var/log/rad \
|
|
&& chown -R appuser:appuser /var/log/rad
|
|
|
|
# Copy project files into image and set ownership during copy (faster than
|
|
# a separate `chown -R` step). This keeps layer reuse efficient.
|
|
COPY --chown=appuser:appuser . /usr/src/app
|
|
|
|
# Make the entrypoint executable (some files in the repo may not have the
|
|
# executable bit set). Do this as root before switching to the app user.
|
|
RUN [ -f /usr/src/app/entrypoint.sh ] && chmod +x /usr/src/app/entrypoint.sh || true
|
|
USER appuser
|
|
|
|
ENTRYPOINT ["/usr/src/app/entrypoint.sh"]
|