|
1 | | -# Stage 1: Build |
2 | | -FROM python:3.12-slim-bookworm AS build |
| 1 | +# - Stage 1 -------------------------------------------------------------------- |
3 | 2 |
|
4 | | -WORKDIR /app |
| 3 | + FROM python:3.12-slim-bookworm AS build |
5 | 4 |
|
6 | | -COPY requirements.txt . |
7 | | -RUN pip install --no-cache-dir -r requirements.txt |
| 5 | + WORKDIR /app |
8 | 6 |
|
9 | | -COPY . . |
| 7 | + # Install build tools needed to compile some Python packages |
| 8 | + RUN apt-get update && apt-get install -y --no-install-recommends \ |
| 9 | + build-essential gcc && \ |
| 10 | + rm -rf /var/lib/apt/lists/* |
10 | 11 |
|
11 | | -# Stage 2: Runtime |
12 | | -FROM python:3.12-slim-bookworm AS runtime |
| 12 | + # Copy and build all required packages (with dependencies) into wheels |
| 13 | + COPY requirements.txt . |
| 14 | + RUN pip wheel --no-cache -r requirements.txt -w /app/wheelhouse |
13 | 15 |
|
14 | | -WORKDIR /app |
| 16 | + # Copy full app source (not strictly needed in build stage unless building static assets) |
| 17 | + COPY . . |
15 | 18 |
|
16 | | -COPY requirements.txt . |
17 | | -RUN pip install --no-cache-dir -r requirements.txt |
| 19 | +# - Stage 2 -------------------------------------------------------------------- |
18 | 20 |
|
19 | | -COPY models ./models |
20 | | -COPY routes ./routes |
21 | | -COPY schemas ./schemas |
22 | | -COPY services ./services |
23 | | -COPY data ./data |
24 | | -COPY main.py . |
| 21 | + FROM python:3.12-slim-bookworm AS runtime |
25 | 22 |
|
26 | | -# Add non-root 'fastapi' user (optional for hardening) |
27 | | -RUN adduser --disabled-password --gecos '' fastapi \ |
28 | | - && chown -R fastapi:fastapi /app |
29 | | -USER fastapi |
| 23 | + WORKDIR /app |
30 | 24 |
|
31 | | -EXPOSE 9000 |
32 | | -ENV PYTHONUNBUFFERED=1 |
| 25 | + # Only bring in requirements and prebuilt wheels from build stage |
| 26 | + COPY requirements.txt . |
| 27 | + COPY --from=build /app/wheelhouse /app/wheelhouse |
33 | 28 |
|
34 | | -CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "9000"] |
| 29 | + # Install app dependencies from local wheelhouse |
| 30 | + RUN pip install --no-cache-dir --no-index --find-links /app/wheelhouse -r requirements.txt |
| 31 | + |
| 32 | + # Copy only the necessary runtime source files |
| 33 | + COPY models ./models |
| 34 | + COPY routes ./routes |
| 35 | + COPY schemas ./schemas |
| 36 | + COPY services ./services |
| 37 | + COPY data ./data |
| 38 | + COPY main.py . |
| 39 | + |
| 40 | + # Add non-root user for security hardening |
| 41 | + RUN adduser --disabled-password --gecos '' fastapi && \ |
| 42 | + chown -R fastapi:fastapi /app |
| 43 | + USER fastapi |
| 44 | + |
| 45 | + # Prevent Python from buffering stdout/stderr |
| 46 | + ENV PYTHONUNBUFFERED=1 |
| 47 | + |
| 48 | + # Expose FastAPI port |
| 49 | + EXPOSE 9000 |
| 50 | + |
| 51 | + # Start the FastAPI app with Uvicorn |
| 52 | + CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "9000"] |
0 commit comments