curo1305andClaude Sonnet 4.6
382f9bec6b
Apply all available OS security updates in the runtime image stage to pull in openssl 3.5.5-1~deb13u2 (fixes CVE-2026-31789 heap buffer overflow). Three CVEs with no upstream fix (Mesa will_not_fix, perl-base affected) documented and suppressed in .trivyignore with rationale. Trivy rescan exits 0 (D-10 gate passes). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
37 lines
953 B
Docker
37 lines
953 B
Docker
# Stage 1: builder — compiles Python packages that need gcc
|
|
FROM python:3.12-slim AS builder
|
|
|
|
WORKDIR /build
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
gcc \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
|
|
|
|
# Stage 2: runtime — lean image with only what the app needs at runtime
|
|
FROM python:3.12-slim AS runtime
|
|
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y --no-install-recommends \
|
|
&& apt-get install -y --no-install-recommends \
|
|
tesseract-ocr \
|
|
libgl1 \
|
|
libglib2.0-0 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /install /usr/local
|
|
|
|
RUN groupadd --gid 1000 appgroup \
|
|
&& useradd --uid 1000 --gid appgroup --shell /bin/sh --no-create-home appuser
|
|
|
|
WORKDIR /app
|
|
COPY --chown=appuser:appgroup . .
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
|