Move to two stage docker build for the operator

Author: JohnGarbutt

python/Dockerfile

@@ -1,4 +1,34 @@
-FROM python:3.9
+FROM ubuntu:jammy as build-image
+
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get install --no-install-recommends python3.10-venv git -y && \
+    rm -rf /var/lib/apt/lists/*
+
+# build into a venv we can copy across
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+COPY ./requirements.txt /perftest/
+RUN pip install -U pip setuptools
+RUN pip install --no-deps --requirement /perftest/requirements.txt
+
+COPY . /perftest
+RUN pip install -e /perftest
+
+#
+# Now the image we run with
+#
+FROM ubuntu:jammy as run-image
+
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get install --no-install-recommends python3 tini ca-certificates -y && \
+    rm -rf /var/lib/apt/lists/*
+
+# Copy accross the venv
+COPY --from=build-image /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 
 # Create the user that will be used to run the app
 ENV APP_UID 1001
@@ -22,14 +52,9 @@ RUN apt-get update && \
 # Don't buffer stdout and stderr as it breaks realtime logging
 ENV PYTHONUNBUFFERED 1
 
-# Install dependencies
-# Doing this separately by copying only the requirements file enables better use of the build cache
-COPY ./requirements.txt /perftest/
-RUN pip install --no-deps --requirement /perftest/requirements.txt
-
-# Install the perftest package
-COPY . /perftest
-RUN pip install --no-deps -e /perftest
+# Make httpx use the system trust roots
+# By default, this means we use the CAs from the ca-certificates package
+ENV SSL_CERT_FILE /etc/ssl/certs/ca-certificates.crt
 
 # By default, run the operator using kopf
 USER $APP_UID