136 lines
3.9 KiB
Docker
136 lines
3.9 KiB
Docker
FROM ubuntu:noble AS build
|
|
|
|
# The following does not work in Podman unless you build in Docker
|
|
# compatibility mode: <https://github.com/containers/podman/issues/8477>
|
|
# You can manually prepend every RUN script with `set -ex` too.
|
|
# SHELL ["sh", "-exc"]
|
|
|
|
### Start build prep.
|
|
### This should be a separate build container for better reuse.
|
|
|
|
RUN <<EOT
|
|
apt-get update -qy
|
|
apt-get install -qyy \
|
|
-o APT::Install-Recommends=false \
|
|
-o APT::Install-Suggests=false \
|
|
build-essential \
|
|
ca-certificates \
|
|
python3-setuptools \
|
|
python3.12-dev
|
|
EOT
|
|
|
|
# Security-conscious organizations should package/review uv themselves.
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
|
|
# - Silence uv complaining about not being able to use hard links,
|
|
# - tell uv to byte-compile packages for faster application startups,
|
|
# - prevent uv from accidentally downloading isolated Python builds,
|
|
# - pick a Python,
|
|
# - and finally declare `/app` as the target for `uv sync`.
|
|
ENV UV_LINK_MODE=copy \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
UV_PYTHON_DOWNLOADS=never \
|
|
UV_PYTHON=python3.12 \
|
|
UV_PROJECT_ENVIRONMENT=/app
|
|
|
|
### End build prep -- this is where your app Dockerfile should start.
|
|
|
|
# Since there's no point in shipping lock files, we move them
|
|
# into a directory that is NOT copied into the runtime image.
|
|
# The trailing slash makes COPY create `/_lock/` automagically.
|
|
COPY pyproject.toml /_lock/
|
|
COPY uv.lock /_lock/
|
|
|
|
# Synchronize DEPENDENCIES without the application itself.
|
|
# This layer is cached until uv.lock or pyproject.toml change.
|
|
# You can create `/app` using `uv venv` in a separate `RUN`
|
|
# step to have it cached, but with uv it's so fast, it's not worth
|
|
# it, so we let `uv sync` create it for us automagically.
|
|
RUN --mount=type=cache,target=/root/.cache <<EOT
|
|
cd /_lock
|
|
mkdir -p src/fastapi_dynamic_response
|
|
echo '__version__ = "0.0.0"' > src/fastapi_dynamic_response/__about__.py
|
|
touch README.md
|
|
uv sync \
|
|
--locked \
|
|
--no-dev \
|
|
--no-install-project
|
|
EOT
|
|
|
|
# Now install the APPLICATION from `/src` without any dependencies.
|
|
# `/src` will NOT be copied into the runtime container.
|
|
# LEAVE THIS OUT if your application is NOT a proper Python package.
|
|
# As of uv 0.4.11, you can also use
|
|
# `cd /src && uv sync --locked --no-dev --no-editable` instead.
|
|
COPY . /src
|
|
RUN --mount=type=cache,target=/root/.cache \
|
|
uv pip install \
|
|
--python=$UV_PROJECT_ENVIRONMENT \
|
|
--no-deps \
|
|
/src
|
|
|
|
|
|
##########################################################################
|
|
|
|
FROM ubuntu:noble
|
|
# SHELL ["sh", "-exc"]
|
|
|
|
# Optional: add the application virtualenv to search path.
|
|
ENV PATH=/app/bin:$PATH
|
|
|
|
# Don't run your app as root.
|
|
RUN <<EOT
|
|
groupadd -r app
|
|
useradd -r -d /app -g app -N app
|
|
EOT
|
|
|
|
ENTRYPOINT ["/docker-entrypoint.sh"]
|
|
# See <https://hynek.me/articles/docker-signals/>.
|
|
STOPSIGNAL SIGINT
|
|
|
|
# Note how the runtime dependencies differ from build-time ones.
|
|
# Notably, there is no uv either!
|
|
RUN <<EOT
|
|
apt-get update -qy
|
|
apt-get install -qyy \
|
|
-o APT::Install-Recommends=false \
|
|
-o APT::Install-Suggests=false \
|
|
python3.12 \
|
|
libpython3.12 \
|
|
libpcre3 \
|
|
libxml2
|
|
|
|
apt-get clean
|
|
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
|
|
EOT
|
|
|
|
COPY docker-entrypoint.sh /
|
|
|
|
# Copy the pre-built `/app` directory to the runtime container
|
|
# and change the ownership to user app and group app in one step.
|
|
COPY --from=build --chown=app:app /app /app
|
|
|
|
# If your application is NOT a proper Python package that got
|
|
# pip-installed above, you need to copy your application into
|
|
# the container HERE:
|
|
# COPY . /app/whereever-your-entrypoint-finds-it
|
|
|
|
USER app
|
|
WORKDIR /app
|
|
|
|
# Strictly optional, but I like it for introspection of what I've built
|
|
# and run a smoke test that the application can, in fact, be imported.
|
|
RUN <<EOT
|
|
set -e
|
|
python -V
|
|
python -Im site
|
|
python -Ic 'import fastapi_dynamic_response'
|
|
EOT
|
|
|
|
COPY static static
|
|
COPY templates templates
|
|
|
|
EXPOSE 8000
|
|
|
|
ENTRYPOINT ["fdr_app"]
|
|
CMD ["app", "run", ]
|