71 lines
2.2 KiB
Docker
71 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1.5
|
|
FROM python:3.11-slim AS builder
|
|
|
|
ARG APT_PROXY=http://192.168.88.14:3142
|
|
|
|
WORKDIR /app
|
|
|
|
# Configure apt to use apt-cacher-ng (overrideable via --build-arg APT_PROXY="<url>")
|
|
RUN printf 'Acquire::http::Proxy "%s";\nAcquire::https::Proxy "%s";\n' "$APT_PROXY" "$APT_PROXY" > /etc/apt/apt.conf.d/01proxy
|
|
|
|
# Install build deps (minimal)
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends build-essential ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy only what's needed for dependency resolution to leverage cache
|
|
COPY requirements.txt ./requirements.txt
|
|
|
|
# Use BuildKit cache mount for pip wheels/cache to speed up rebuilds when available
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
python -m pip install --upgrade pip \
|
|
&& python -m pip install --prefix /app/_deps -r requirements.txt
|
|
|
|
# Copy application source
|
|
COPY . /app/src
|
|
|
|
FROM python:3.11-slim
|
|
|
|
ARG APT_PROXY=http://192.168.88.14:3142
|
|
|
|
WORKDIR /app
|
|
|
|
# Configure apt to use apt-cacher-ng in the runtime stage as well
|
|
RUN printf 'Acquire::http::Proxy "%s";\nAcquire::https::Proxy "%s";\n' "$APT_PROXY" "$APT_PROXY" > /etc/apt/apt.conf.d/01proxy
|
|
|
|
# Create non-root user
|
|
RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
|
|
|
|
# Copy installed deps from builder
|
|
COPY --from=builder /app/_deps /app/_deps
|
|
ENV PYTHONPATH=/app/_deps/lib/python3.11/site-packages:/app
|
|
ENV PATH=/app/_deps/bin:$PATH
|
|
|
|
# Copy application code and entrypoint
|
|
COPY --from=builder /app/src /app
|
|
COPY entrypoint.sh /app/entrypoint.sh
|
|
RUN chmod +x /app/entrypoint.sh
|
|
|
|
# Install only runtime packages required (curl for healthcheck). keep packages minimal.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends curl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& mkdir -p /app/data \
|
|
&& chown -R appuser:appgroup /app/data
|
|
|
|
USER appuser
|
|
|
|
ENV FLASK_APP=app.py
|
|
ENV FLASK_RUN_HOST=0.0.0.0
|
|
ENV PYTHONUNBUFFERED=1
|
|
ENV GUNICORN_WORKERS=2
|
|
ENV GUNICORN_TIMEOUT=30
|
|
|
|
EXPOSE 5002
|
|
|
|
# Docker HEALTHCHECK: check the /health endpoint
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD curl -f http://localhost:5002/health || exit 1
|
|
|
|
# Default to the entrypoint script which computes worker count if not provided
|
|
ENTRYPOINT ["/app/entrypoint.sh"]
|