curo1305
a5baef73d9
- backend: appuser UID/GID 1001 via useradd, USER directive, --chown on COPY - frontend builder: appuser UID/GID 1001 via adduser, USER directive - frontend prod: switch to nginxinc/nginx-unprivileged:alpine (nginx UID 101), listen on 8080 - docker-compose: explicit user: for all services (70:70 db, 1001:1001 backend/frontend-dev, 101:101 frontend-prod) - nginx.conf: listen 8080 to match unprivileged image Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
33 lines
1.0 KiB
Docker
33 lines
1.0 KiB
Docker
# ── Stage 1: dependency installation ─────────────────────────────────────────
|
|
FROM python:3.12-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
RUN pip install --upgrade pip
|
|
|
|
COPY pyproject.toml .
|
|
RUN pip install --prefix=/install .
|
|
|
|
# ── Stage 2: runtime ──────────────────────────────────────────────────────────
|
|
FROM python:3.12-slim
|
|
|
|
# Create non-root user (UID/GID 1001)
|
|
RUN groupadd --gid 1001 appuser && \
|
|
useradd --uid 1001 --gid 1001 --no-create-home --shell /bin/sh appuser
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy installed packages from builder
|
|
COPY --from=builder /install /usr/local
|
|
|
|
# Copy application source with correct ownership
|
|
COPY --chown=appuser:appuser app ./app
|
|
COPY --chown=appuser:appuser alembic ./alembic
|
|
COPY --chown=appuser:appuser alembic.ini .
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
|