49 lines
1.8 KiB
Docker
49 lines
1.8 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ============================================================================
|
|
# Build stage: install Python dependencies into a dedicated prefix
|
|
# ============================================================================
|
|
FROM python:3.11-slim-bookworm AS builder
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
# Install runtime deps into /install. --target keeps everything in one tree
|
|
# so we can copy it cleanly to a distroless image without venv/shebang issues.
|
|
RUN pip install --target=/install \
|
|
fastapi==0.115.* \
|
|
"uvicorn[standard]==0.30.*" \
|
|
redis==5.0.*
|
|
|
|
# Pre-compile bytecode for faster cold start under a read-only rootfs
|
|
RUN python -m compileall -q /install
|
|
|
|
# ============================================================================
|
|
# Runtime stage: distroless Python 3.11, non-root, no shell
|
|
# ============================================================================
|
|
# gcr.io/distroless/python3-debian12 ships Python 3.11 with NO shell, NO
|
|
# package manager, and NO setuid binaries. The :nonroot tag pins USER to
|
|
# uid 65532 / gid 65532.
|
|
FROM gcr.io/distroless/python3-debian12:nonroot
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONPATH=/app/lib
|
|
|
|
WORKDIR /app
|
|
|
|
# Site-packages first (rarely changes → maximises layer cache)
|
|
COPY --from=builder --chown=nonroot:nonroot /install /app/lib
|
|
|
|
# Application source (changes most often → its own layer)
|
|
COPY --chown=nonroot:nonroot app.py favicon.ico /app/
|
|
|
|
USER nonroot
|
|
EXPOSE 8000
|
|
|
|
# Module form (-m uvicorn) sidesteps broken shebangs in /app/lib/bin/uvicorn
|
|
# (those were generated against the builder's Python path, not distroless's).
|
|
ENTRYPOINT ["/usr/bin/python3", "-m", "uvicorn"]
|
|
CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"]
|