File size: 1,738 Bytes
eff6797 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 | # Multi-Stage Production Dockerfile for CFI Backend API & ML Engine
# Stage 1: Build virtual environment with pre-compiled wheels
FROM python:3.12-slim-bookworm AS builder
WORKDIR /build
ENV PYTHONUNBUFFERED=1 \
PYTHONDONTWRITEBYTECODE=1 \
PIP_NO_CACHE_DIR=1
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
curl \
git \
libpq-dev \
&& rm -rf /var/lib/apt/lists/*
RUN pip install --no-cache-dir uv
COPY backend/requirements.txt ./
RUN uv venv /opt/venv && \
. /opt/venv/bin/activate && \
uv pip install --no-cache -r requirements.txt
# Stage 2: Hardened, non-root production runtime
FROM python:3.12-slim-bookworm AS runtime
WORKDIR /app
ENV PYTHONUNBUFFERED=1 \
PYTHONDONTWRITEBYTECODE=1 \
PATH="/opt/venv/bin:$PATH" \
PYTHONPATH="/app/backend" \
APP_ENV="production" \
HOME="/home/user" \
CFI_STORAGE_DIR="/app/storage"
RUN apt-get update && apt-get install -y --no-install-recommends \
curl \
libpq5 \
&& rm -rf /var/lib/apt/lists/* \
&& groupadd -g 1000 user \
&& useradd -u 1000 -g user -m -d /home/user -s /bin/sh user \
&& mkdir -p /home/user /app/storage /app/logs /tmp/cfi_storage \
&& chmod -R 777 /home/user /app /tmp/cfi_storage \
&& chown -R user:user /home/user /app /tmp/cfi_storage
COPY --from=builder /opt/venv /opt/venv
COPY --chown=user:user backend /app/backend
RUN chmod -R 777 /home/user /app/storage /app/logs /tmp/cfi_storage
USER user
EXPOSE 8000 50051
HEALTHCHECK --interval=10s --timeout=3s --start-period=20s --retries=3 \
CMD curl -f http://127.0.0.1:8000/health || exit 1
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "2"]
|