Skip to content

Commit 6837f3d

Browse files
warix8NakoGH
warix8
and
NakoGH
authored
Deploy/single stage docker (#852)
This pull request is part of a clarification process aimed at simplifying handovers and maintainability. Here, it is a clean-up of the Docker image build. The multi-stage build of the Docker image is not at all suitable in our case, and was used to create a kind of ‘cache’, which can in fact be easily resolved as mentioned in the FastAPI documentation as a Docker ‘trick’. The idea is to use --upgrade on pip install to take advantage of layer caching. [Reference FastAPI](https://fastapi.tiangolo.com/deployment/docker/?h=docke#docker-cache) In addition, using a slim image means that only the strictly necessary tools are included. A multi-stage build image is relevant in the case of a compilation where the code is subsequently executed in a lighter environment, which then contains fewer vulnerabilities and is lighter. The publish.yml has therefore been restored to its original version. --------- Co-authored-by: Rayan <[email protected]>
1 parent d3477af commit 6837f3d

File tree

12 files changed

+179
-133
lines changed

12 files changed

+179
-133
lines changed

‎.github/workflows/alpha-publish.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Publish Alpha
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches:
7+
- main
8+
9+
jobs:
10+
build-and-deploy-alpha:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout code
15+
uses: actions/checkout@v5
16+
with:
17+
ref: "main"
18+
19+
- name: Set up Docker Buildx
20+
uses: docker/[email protected]
21+
22+
- name: Login to GitHub Container Registry
23+
uses: docker/[email protected]
24+
with:
25+
registry: ${{ secrets.DOCKER_REGISTRY_URL }}
26+
username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
27+
password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
28+
29+
- name: Docker metadata
30+
id: meta
31+
uses: docker/[email protected]
32+
with:
33+
images: ${{ secrets.DOCKER_REGISTRY_URL }}/hyperion
34+
tags: |
35+
type=raw,value=alpha
36+
labels: |
37+
preprod.environment=${{ github.event.inputs.preprod_env }}
38+
preprod.branch=${{ github.event.inputs.branch }}
39+
40+
- name: Build and push preprod image
41+
uses: docker/[email protected]
42+
with:
43+
context: .
44+
platforms: linux/amd64 #,linux/arm64
45+
push: true
46+
tags: ${{ steps.meta.outputs.tags }}
47+
labels: ${{ steps.meta.outputs.labels }}
48+
cache-from: |
49+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:latest
50+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:alpha
51+
cache-to: type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/${{ github.repository }}/cache,mode=max

‎.github/workflows/lintandformat.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ jobs:
1616

1717
# Setup Python (faster than using Python container)
1818
- name: Setup Python
19-
uses: actions/setup-python@v5
19+
uses: actions/setup-python@v6
2020
id: setup-python
2121
with:
2222
python-version: "3.11"
2323

2424
- name: Cache uv folder
2525
id: cache-uv
26-
uses: actions/cache@v4
26+
uses: actions/cache@v4.3.0
2727
with:
2828
path: ~/.cache/uv
2929
key: ${{ runner.os }}-python-${{ steps.setup-python.outputs.python-version }}-uv-${{ hashFiles('requirements-common.txt', 'requirements-dev.txt') }}
@@ -36,7 +36,7 @@ jobs:
3636

3737
- name: Cache .ruff_cache folder
3838
id: ruff_cache
39-
uses: actions/cache@v4
39+
uses: actions/cache@v4.3.0
4040
with:
4141
path: .ruff_cache
4242
key: ruff_cache-${{ github.head_ref }}
@@ -48,7 +48,7 @@ jobs:
4848
4949
- name: Cache .mypy_cache folder
5050
id: mypy_cache
51-
uses: actions/cache@v4
51+
uses: actions/cache@v4.3.0
5252
with:
5353
path: .mypy_cache
5454
key: mypy_cache-${{ github.head_ref }}

‎.github/workflows/preprod-publish.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Publish Preprod
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
branch:
7+
description: "Branch to deploy in preprod"
8+
required: true
9+
default: "main"
10+
preprod_env:
11+
description: "Preprod environment"
12+
required: true
13+
type: choice
14+
options:
15+
- preprod-1
16+
- preprod-2
17+
- preprod-3
18+
- preprod-4
19+
- preprod-5
20+
- preprod-6
21+
- preprod-7
22+
- preprod-8
23+
- preprod-9
24+
default: "preprod-1"
25+
26+
jobs:
27+
build-and-deploy-preprod:
28+
runs-on: ubuntu-latest
29+
30+
steps:
31+
- name: Checkout code
32+
uses: actions/checkout@v5
33+
with:
34+
ref: ${{ github.event.inputs.branch }}
35+
36+
- name: Set up Docker Buildx
37+
uses: docker/[email protected]
38+
39+
- name: Login to GitHub Container Registry
40+
uses: docker/[email protected]
41+
with:
42+
registry: ${{ secrets.DOCKER_REGISTRY_URL }}
43+
username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
44+
password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
45+
46+
- name: Docker metadata
47+
id: meta
48+
uses: docker/[email protected]
49+
with:
50+
images: ${{ secrets.DOCKER_REGISTRY_URL }}/hyperion
51+
tags: |
52+
type=raw,value=${{ github.event.inputs.preprod_env }}
53+
type=raw,value=preprod-latest,enable={{is_default_branch}}
54+
type=sha,prefix={{branch}}-
55+
labels: |
56+
preprod.environment=${{ github.event.inputs.preprod_env }}
57+
preprod.branch=${{ github.event.inputs.branch }}
58+
59+
- name: Build and push preprod image
60+
uses: docker/[email protected]
61+
with:
62+
context: .
63+
platforms: linux/amd64 #,linux/arm64
64+
push: true
65+
tags: ${{ steps.meta.outputs.tags }}
66+
labels: ${{ steps.meta.outputs.labels }}
67+
cache-from: |
68+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:${{ github.event.inputs.preprod_env }}
69+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:alpha
70+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:latest
71+
cache-to: type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/${{ github.repository }}/cache,mode=max

‎.github/workflows/publish.yml‎

Lines changed: 10 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ on:
33
workflow_dispatch:
44
push:
55
tags:
6-
- 'v*.*.*'
6+
- "v*.*.*"
77

88
jobs:
99
docker:
@@ -14,59 +14,35 @@ jobs:
1414
- name: Check out the code
1515
uses: actions/checkout@v5
1616

17-
- name: Calculate requirements md5
18-
run: |
19-
echo "REQUIREMENTS_MD5=$(cat requirements-common.txt requirements-prod.txt | md5sum | cut -d ' ' -f 1)" >> $GITHUB_ENV
20-
21-
- name: Check if base image exists
22-
run: |
23-
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
24-
-u ${{ secrets.DOCKER_REGISTRY_USERNAME }}:${{ secrets.DOCKER_REGISTRY_PASSWORD }} \
25-
-H "Accept: application/vnd.oci.image.index.v1+json" \
26-
"${{ secrets.DOCKER_REGISTRY_URL }}/v2/hyperion-base/manifests/${{ env.REQUIREMENTS_MD5 }}")
27-
28-
echo "HTTP_CODE=$HTTP_CODE" >> $GITHUB_ENV
29-
30-
if [ "$HTTP_CODE" -ne 200 ]; then
31-
echo "Error: Base image not found, wait for the base image to be built first"
32-
exit 1
33-
fi
34-
35-
echo "EXISTS=true" >> $GITHUB_ENV
36-
3717
- name: Docker metadata
38-
if: env.EXISTS == 'true'
3918
id: meta
40-
uses: docker/metadata-action@v5
19+
uses: docker/metadata-action@v5.8.0
4120
with:
4221
images: ${{ secrets.DOCKER_REGISTRY_IDENTIFER }}/hyperion
4322
tags: |
4423
type=semver,pattern={{version}}
4524
type=semver,pattern={{major}}.{{minor}}
25+
type=raw,value=latest
4626
4727
- name: Set up Docker Buildx
48-
if: env.EXISTS == 'true'
49-
uses: docker/setup-buildx-action@v3
28+
uses: docker/[email protected]
5029

5130
- name: Login to GitHub Container Registry
52-
if: env.EXISTS == 'true'
53-
uses: docker/login-action@v3
31+
uses: docker/[email protected]
5432
with:
5533
registry: ${{ secrets.DOCKER_REGISTRY_URL }}
5634
username: ${{ secrets.DOCKER_REGISTRY_USERNAME }}
5735
password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}
5836

5937
- name: Build and push app
60-
if: env.EXISTS == 'true'
61-
uses: docker/build-push-action@v6
38+
uses: docker/[email protected]
6239
with:
6340
context: .
6441
platforms: linux/amd64 #,linux/arm64
6542
push: true
6643
tags: ${{ steps.meta.outputs.tags }}
6744
labels: ${{ steps.meta.outputs.labels }}
68-
cache-from: type=gha
69-
cache-to: type=gha,mode=max
70-
build-args: |
71-
REQUIREMENTS_MD5=${{env.REQUIREMENTS_MD5}}
72-
DOCKER_REGISTRY_IDENTIFER=${{ secrets.DOCKER_REGISTRY_IDENTIFER }}
45+
cache-from: |
46+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:alpha
47+
type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/hyperion:latest
48+
cache-to: type=registry,ref=${{ secrets.DOCKER_REGISTRY_URL }}/${{ github.repository }}/cache,mode=max

‎.github/workflows/publishbase.yml‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎.github/workflows/test.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,14 @@ jobs:
5454

5555
# Setup Python (faster than using Python container)
5656
- name: Setup Python
57-
uses: actions/setup-python@v5
57+
uses: actions/setup-python@v6
5858
id: setup-python
5959
with:
6060
python-version: "3.11"
6161

6262
- name: Cache uv folder
6363
id: cache-uv
64-
uses: actions/cache@v4
64+
uses: actions/cache@v4.3.0
6565
with:
6666
path: ~/.cache/uv
6767
key: ${{ runner.os }}-python-${{ steps.setup-python.outputs.python-version }}-uv-${{ hashFiles('requirements-common.txt', 'requirements-dev.txt') }}
@@ -74,16 +74,15 @@ jobs:
7474

7575
- name: Cache .pytest_cache folder
7676
id: pytest_cache
77-
uses: actions/cache@v4
77+
uses: actions/cache@v4.3.0
7878
with:
7979
path: .pytest_cache
8080
key: pytest_cache-${{ github.head_ref }}
81-
8281

8382
- name: Run unit tests with Postgresql
8483
run: python -m pytest --cov
8584

8685
- name: Upload coverage reports to Codecov
87-
uses: codecov/codecov-action@v5
86+
uses: codecov/codecov-action@v5.5.1
8887
env:
8988
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

‎Dockerfile‎

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,46 @@
1-
ARG REQUIREMENTS_MD5
2-
ARG DOCKER_REGISTRY_IDENTIFER
3-
FROM ${DOCKER_REGISTRY_IDENTIFER}/hyperion-base:${REQUIREMENTS_MD5}
1+
FROM ghcr.io/astral-sh/uv:python3.12-trixie-slim
42

3+
# Default number of workers; can be overridden at runtime
4+
ENV WORKERS=1
5+
6+
# Update package list and install weasyprint dependencies
7+
RUN apt-get update && apt-get install -y \
8+
weasyprint \
9+
&& rm -rf /var/lib/apt/lists/*
10+
11+
# Set environment variables to optimize Python behavior in production
512
ENV PYTHONDONTWRITEBYTECODE=1
613
ENV PYTHONUNBUFFERED=1
714
ENV UV_COMPILE_BYTECODE=1
8-
EXPOSE 8000
15+
16+
# Create non-root user early for better security
17+
RUN groupadd --gid 1000 hyperion && \
18+
useradd --uid 1000 --gid hyperion --shell /bin/bash --create-home hyperion
919

1020
WORKDIR /hyperion
1121

12-
COPY pyproject.toml .
22+
# First copy only the requirements to leverage Docker cache
23+
COPY requirements-common.txt .
24+
25+
# Install dependencies using uv (way faster than pip)
26+
RUN uv pip install --system --no-cache -r requirements-common.txt
27+
28+
# Then copy the rest of the application code
1329
COPY alembic.ini .
14-
COPY migrations migrations/
30+
COPY pyproject.toml .
1531
COPY assets assets/
32+
COPY migrations migrations/
1633
COPY app app/
1734

18-
ENTRYPOINT fastapi run app/main.py --workers "${NB_WORKERS:-1}"
35+
# Change ownership of the application directory to the hyperion user
36+
RUN chown -R hyperion:hyperion /hyperion
37+
38+
# Switch to non-root user
39+
USER hyperion
40+
41+
# Expose port 8000
42+
EXPOSE 8000
43+
44+
# Use fastapi cli as the entrypoint
45+
# Use sh -c to allow environment variable expansion
46+
ENTRYPOINT ["sh", "-c", "fastapi run app.main:app --workers $WORKERS --host 0.0.0.0 --port 8000"]

0 commit comments

Comments
 (0)