Merge pull request #90 from alkem-io/dockerfile

Dockerfile (distroless)

Author: valeksiev

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.gitignore
+.vscode
+.venv
+__pycache__
+*.pyc
+*.pyo
+*.pyd
+.DS_Store
+manifests
+.github
+.flake8
+.azure-template.env
+docker-compose.yaml
+Dockerfile
+README.md
+LICENSE

.github/workflows/build-deploy-k8s-sandbox-hetzner.yml

@@ -1,4 +1,4 @@
-name: Build, Migrate & Deploy to Test on Hetzner
+name: Build, Migrate & Deploy to Sandbox on Hetzner
 
 on:
   workflow_dispatch:
@@ -24,6 +24,7 @@ jobs:
 
   deploy:
     runs-on: ubuntu-latest
+    needs: build
     steps:
       - name: "Checkout GitHub Action"
         uses: actions/checkout@v4.1.7

Dockerfile

@@ -1,40 +1,126 @@
-# Use an official Python runtime as a parent image
-ARG PYTHON_VERSION=3.11
-FROM python:${PYTHON_VERSION}-slim-bullseye AS builder
+# =============================================================================
+# Stage 1: Build stage - install dependencies using Debian Python for distroless compatibility
+# =============================================================================
+FROM debian:bookworm-slim AS builder
+
+# Install Python, pip, git and build essentials in a single layer
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        python3 \
+        python3-pip \
+        python3-venv \
+        git \
+        ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
 
-# Set the working directory in the container to /app
 WORKDIR /app
 
-ARG GO_VERSION=1.21.6
+# Install Poetry in a separate venv to avoid PEP 668 issues
+RUN python3 -m venv /opt/poetry && \
+    /opt/poetry/bin/pip install --no-cache-dir poetry && \
+    ln -s /opt/poetry/bin/poetry /usr/local/bin/poetry
+
+# Configure Poetry to create venv in project
+ENV POETRY_NO_INTERACTION=1 \
+    POETRY_VIRTUALENVS_IN_PROJECT=true \
+    POETRY_VIRTUALENVS_CREATE=true \
+    POETRY_CACHE_DIR=/tmp/poetry_cache
+
+# Copy only dependency files first (better layer caching)
+COPY pyproject.toml poetry.lock* ./
+
+# Install dependencies (without dev dependencies)
+RUN poetry install --only main --no-root --no-ansi && \
+    rm -rf $POETRY_CACHE_DIR && \
+    # Remove pip + wheel (keep setuptools for runtime compatibility)
+    /app/.venv/bin/pip uninstall -y pip wheel && \
+    find /app/.venv -type d -name "__pycache__" -exec rm -rf {} + && \
+    # Trim non-runtime content from installed packages
+    SITE_PACKAGES="$(/app/.venv/bin/python -c 'import site; print(site.getsitepackages()[0])')" && \
+    find "$SITE_PACKAGES" -type d \( \
+        -name "tests" -o -name "test" -o \
+        -name "docs" -o -name "doc" -o \
+        -name "examples" -o -name "example" -o \
+        -name "__pycache__" \
+    \) -prune -exec rm -rf '{}' + && \
+    find "$SITE_PACKAGES" -type f -name "*.pyc" -delete
+
+# Copy application code (kept after dependency install for better caching)
+COPY . /app
+
+# Create files/dirs that the distroless runtime cannot create (no shell)
+RUN touch /app/app.log
+
+# =============================================================================
+# Stage 2: Runtime stage - Google distroless Python image
+# =============================================================================
+# NOTE: This image does NOT include Git or Hugo. The 'ingest' operation 
+# will NOT work. Use the 'runtime-full' target if you need ingest capability.
+# =============================================================================
+FROM gcr.io/distroless/python3-debian12:nonroot AS runtime
+
+# Copy the prebuilt app (code + venv + log file) from the builder.
+# Use UID/GID 1000 to stay compatible with typical host-mounted volumes.
+COPY --from=builder --chown=1000:1000 /app /app
+
+WORKDIR /app
+
+# Set PATH to use the venv's python executable
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH="/app/.venv/lib/python3.11/site-packages:/app"
+
+# Explicitly define the user
+USER 1000:1000
+
+# Run main.py using the venv python
+ENTRYPOINT ["/app/.venv/bin/python", "main.py"]
+
+# =============================================================================
+# Stage 3: Full runtime with Git and Hugo (for ingest capability)
+# =============================================================================
+FROM debian:bookworm-slim AS runtime-full
+
 ARG HUGO_VERSION=0.121.2
 ARG TARGETARCH
 
-# install wget and git
-RUN apt-get update -y \
-  && apt-get upgrade -y \
-  && apt-get install -y git wget \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+
+# Install runtime dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        python3 \
+        git \
+        ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
 
-RUN wget https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz && tar -C /usr/local -xzf go${GO_VERSION}.linux-${TARGETARCH}.tar.gz 
+# Install Hugo
+ADD https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-${TARGETARCH}.tar.gz /tmp/hugo.tar.gz
+RUN tar -C /usr/local/bin -xzf /tmp/hugo.tar.gz hugo \
+  && rm /tmp/hugo.tar.gz \
+  && hugo version
 
-ENV PATH="/usr/local/go/bin:/usr/local:${PATH}"
-RUN go version
+# Create non-root user
+RUN useradd --create-home --uid 1000 --shell /bin/bash appuser
 
-RUN wget https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-${TARGETARCH}.tar.gz \
-  && tar -C /bin -xzf hugo_extended_${HUGO_VERSION}_linux-${TARGETARCH}.tar.gz \
-  && rm hugo_extended_${HUGO_VERSION}_linux-${TARGETARCH}.tar.gz
+# Copy virtual environment from builder
+COPY --from=builder --chown=appuser:appuser /app/.venv /app/.venv
 
-RUN hugo version
+# Copy application code
+COPY --chown=appuser:appuser . .
 
-# Install Poetry
-RUN pip install poetry
+# Create a writable log file for the appuser
+RUN touch /app/app.log && chown appuser:appuser /app/app.log
 
-# Copy the current directory contents into the container at /app
-COPY . /app
+# Set environment variables
+ENV VIRTUAL_ENV=/app/.venv \
+    PATH="/app/.venv/bin:$PATH" \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
 
-# # Use Poetry to install dependencies
-RUN poetry config virtualenvs.create true && poetry install --no-interaction --no-ansi
+# Switch to non-root user
+USER appuser
 
 # Run main.py when the container launches
-CMD ["poetry", "run", "python", "main.py"]
+ENTRYPOINT ["/app/.venv/bin/python", "main.py"]