Phillip Tarrant
78dd1ac243
Scaffold app/ package, pinned requirements.txt, multi-stage Dockerfile,
docker-compose.yml, and .env.example. Add typed pydantic-settings loader
with full env contract and a production validator that refuses the
dev-sentinel SECRET_KEY. Wire structlog with an APP_ENV-driven renderer
(console in dev, JSON in prod). Ship a minimal unauthenticated /healthz
returning {status, version, commit_sha} with commit SHA fed through a
GIT_COMMIT_SHA build arg.
Also mark Phase 0 complete in docs/ROADMAP.md.
91 lines
3.2 KiB
Docker
91 lines
3.2 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Chicken Babies R Us — container image
|
|
#
|
|
# Multi-stage build:
|
|
# builder - install build deps, create a venv, resolve Python requirements
|
|
# runtime - slim image with only runtime libs + the copied venv + app code
|
|
#
|
|
# Phase 0 scope: runs as root and has no HEALTHCHECK directive. Phase 6
|
|
# (per docs/ROADMAP.md) introduces a non-root user and a HEALTHCHECK.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
ARG PYTHON_IMAGE=python:3.12-slim-bookworm
|
|
|
|
# ==== Stage 1: builder =====================================================
|
|
FROM ${PYTHON_IMAGE} AS builder
|
|
|
|
# Avoid interactive apt prompts and keep pip quiet + deterministic.
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PYTHONDONTWRITEBYTECODE=1
|
|
|
|
# Build dependencies: `build-essential` covers any wheel that needs to
|
|
# compile from source; libmagic headers are required by python-magic.
|
|
# Keep this list minimal to reduce attack surface of the builder stage.
|
|
RUN apt-get update \
|
|
&& apt-get install --no-install-recommends -y \
|
|
build-essential \
|
|
libmagic1 \
|
|
libmagic-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Dedicated virtualenv at a stable path so the runtime stage can copy it
|
|
# verbatim. This keeps the runtime image free of build tooling.
|
|
RUN python -m venv /opt/venv
|
|
ENV PATH="/opt/venv/bin:${PATH}"
|
|
|
|
WORKDIR /build
|
|
|
|
# Install Python dependencies. Copying only requirements.txt first lets
|
|
# Docker cache the dependency layer when application code changes.
|
|
COPY requirements.txt /build/requirements.txt
|
|
RUN pip install --upgrade pip \
|
|
&& pip install --no-cache-dir -r requirements.txt
|
|
|
|
|
|
# ==== Stage 2: runtime =====================================================
|
|
FROM ${PYTHON_IMAGE} AS runtime
|
|
|
|
# Runtime-only libs: python-magic needs libmagic1 at import time. Build
|
|
# tooling is intentionally NOT installed here.
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install --no-install-recommends -y \
|
|
libmagic1 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy the pre-built virtualenv from the builder stage and put it first
|
|
# on PATH so `python` and installed console scripts (uvicorn) resolve.
|
|
COPY --from=builder /opt/venv /opt/venv
|
|
ENV PATH="/opt/venv/bin:${PATH}"
|
|
|
|
WORKDIR /app
|
|
|
|
# Application source. Only the `app/` package is needed at runtime; tests
|
|
# and docs stay out of the image.
|
|
COPY app /app/app
|
|
|
|
# Git commit SHA wired in at build time. Declared as an ARG with a safe
|
|
# default so local builds without --build-arg still succeed; surfaced to
|
|
# runtime via an ENV so the Settings loader can pick it up.
|
|
ARG GIT_COMMIT_SHA=unknown
|
|
ENV GIT_COMMIT_SHA=${GIT_COMMIT_SHA}
|
|
|
|
EXPOSE 8000
|
|
|
|
# Run Uvicorn directly. --proxy-headers + --forwarded-allow-ips make
|
|
# Starlette's ProxyHeadersMiddleware trust X-Forwarded-* only from the
|
|
# listed peer IPs (Caddy on the host). No --reload: this is a prod-shape
|
|
# image; local hot-reload is a dev concern and runs outside Docker.
|
|
CMD ["uvicorn", "app.main:app", \
|
|
"--host", "0.0.0.0", \
|
|
"--port", "8000", \
|
|
"--proxy-headers", \
|
|
"--forwarded-allow-ips", "127.0.0.1"]
|