secure install

.github/workflows/test.yml

@@ -27,7 +27,7 @@ jobs:
         with:
           file: src/templates/rpc/Dockerfile_rpc
           context: .
-          tags: local/warnet-rpc:ci
+          tags: warnet/dev
           cache-from: type=gha
           cache-to: type=gha,mode=max
           outputs: type=docker,dest=/tmp/warnet.tar

docs/install.md

@@ -79,5 +79,6 @@ source .venv/bin/activate
 
 ```bash
 pip install --upgrade pip
+pip install --require-hashes --no-deps --system --no-cache -r requirements.txt
 pip install -e .
 ```

justfile

@@ -21,6 +21,10 @@ start:
 
     minikube start --mount --mount-string="$PWD:/mnt/src"
 
+    # Build image in local registry and load into minikube
+    docker build -t warnet/dev -f src/templates/rpc/Dockerfile_rpc_dev . --load
+    minikube image load warnet/dev
+
     # Setup k8s
     kubectl apply -f src/templates/rpc/namespace.yaml
     kubectl apply -f src/templates/rpc/rbac-config.yaml
@@ -87,4 +91,4 @@ installlogging:
     ./src/templates/k8s/install_logging.sh
 
 connectlogging:
-    ./src/templates/k8s/connect_logging.sh
+    ./src/templates/k8s/connect_logging.sh

pyproject.toml

@@ -18,9 +18,6 @@ dynamic = ["version", "dependencies"]
 warnet = "warnet.server:run_server"
 warcli = "cli.main:cli"
 
-[tool.setuptools.dynamic]
-dependencies = {file = ["requirements.txt"]}
-
 [tool.setuptools.packages.find]
 where = ["src"]
 

src/templates/rpc/Dockerfile_rpc

@@ -1,17 +1,26 @@
 # Use an official Python runtime as the base image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install procps, which includes pgrep
 RUN apt-get update && \
     apt-get install -y procps openssh-client && \
     rm -rf /var/lib/apt/lists/*
 
+# Install `uv` packge installer (https://github.com/astral-sh/uv)
+RUN pip install uv
+
 # Set the working directory in the container
 WORKDIR /root/warnet
 
+# Get better caching by installing before copying code
+COPY requirements.txt .
+# Require hashes on requirements for secure installs
+RUN uv pip install --require-hashes --no-deps --system --no-cache -r requirements.txt
+
 # Copy the source directory contents into the container
 COPY . /root/warnet
-RUN pip install .
+# Install Warnet scripts
+RUN uv pip install --system .
 
 # Make port 9276 available to the world outside this container
 # Change the port if your server is running on a different port

src/templates/rpc/Dockerfile_rpc_dev

@@ -1,11 +1,14 @@
 # Use an official Python runtime as the base image
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 # Install procps, which includes pgrep
 RUN apt-get update && \
     apt-get install -y procps openssh-client && \
     rm -rf /var/lib/apt/lists/*
 
+# Install `uv` packge installer (https://github.com/astral-sh/uv)
+RUN pip install uv
+
 # Set the working directory in the container
 WORKDIR /root/warnet
 

src/templates/rpc/entrypoint.sh

@@ -31,7 +31,8 @@ done
 if check_setup_toml; then
     echo "Installing package from ${SOURCE_DIR}..."
     cd ${SOURCE_DIR}
-    pip install -e .
+    uv pip install --require-hashes --no-deps --system --no-cache -r requirements.txt
+    uv pip install -e .
 fi
 
 # Execute the CMD from the Dockerfile

src/templates/rpc/warnet-rpc-statefulset-dev.yaml

@@ -16,8 +16,8 @@ spec:
     spec:
       containers:
       - name: warnet-rpc
-        imagePullPolicy: Always
-        image: bitcoindevproject/warnet-rpc:dev
+        imagePullPolicy: Never
+        image: warnet/dev
         ports:
         - containerPort: 9276
         volumeMounts: