curo1305andClaude Sonnet 4.6
378822682c
- backend/Dockerfile: two-stage build (builder/runtime); runtime stage creates appuser uid=1000, copies installed packages from discardable builder stage, runs as non-root USER appuser; no --reload baked in CMD - docker-compose.yml: backend + celery-worker get read_only:true, tmpfs:/tmp:mode=1777, cap_drop:ALL, security_opt:no-new-privileges:true; celery-beat intentionally left unhardened (Pitfall 7 — writes celerybeat-schedule) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
35 lines
883 B
Docker
35 lines
883 B
Docker
# Stage 1: builder — compiles Python packages that need gcc
|
|
FROM python:3.12-slim AS builder
|
|
|
|
WORKDIR /build
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
gcc \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
|
|
|
|
# Stage 2: runtime — lean image with only what the app needs at runtime
|
|
FROM python:3.12-slim AS runtime
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
tesseract-ocr \
|
|
libgl1 \
|
|
libglib2.0-0 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /install /usr/local
|
|
|
|
RUN groupadd --gid 1000 appgroup \
|
|
&& useradd --uid 1000 --gid appgroup --shell /bin/sh --no-create-home appuser
|
|
|
|
WORKDIR /app
|
|
COPY --chown=appuser:appgroup . .
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
|