37 lines
1.1 KiB
Docker
37 lines
1.1 KiB
Docker
FROM python:3.14-slim AS builder
|
|
|
|
ENV UV_LINK_MODE=copy \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
UV_PROJECT_ENVIRONMENT=/app/.venv
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/*
|
|
COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /usr/local/bin/
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-install-project
|
|
COPY monlet_server ./monlet_server
|
|
COPY alembic.ini ./
|
|
COPY alembic ./alembic
|
|
RUN --mount=type=cache,target=/root/.cache/uv uv sync --frozen --no-dev
|
|
|
|
|
|
FROM python:3.14-slim
|
|
ENV PATH="/app/.venv/bin:$PATH" \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
# PH-015: non-root runtime user. UID/GID are stable so bind-mounts can be
|
|
# pre-chowned by operators if they need writable host paths.
|
|
RUN groupadd --system --gid 1000 monlet \
|
|
&& useradd --system --uid 1000 --gid monlet --home-dir /app --shell /usr/sbin/nologin monlet
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder /app /app
|
|
RUN chown -R monlet:monlet /app
|
|
|
|
USER monlet:monlet
|
|
EXPOSE 8000
|
|
STOPSIGNAL SIGTERM
|
|
CMD ["uvicorn", "monlet_server.main:app", "--host", "0.0.0.0", "--port", "8000"]
|