3 Commits

Include renames

Author	SHA1	Message	Date
hermes	c0c6b4c1fc	fix: pin the Python patch version and run the app as a non-root user ... Two follow-ups to the review of the base image change. 1. Pin the patch version: `python:3.14-slim` is a floating tag, so a rebuild could silently pick up a different base image. It is now `python:3.14.10-slim`, so a rebuild is reproducible. 2. Run the app as an unprivileged user. The app only reads its own source and talks to Mongo over the network — it writes no files — so it does not need to be root. A `beer` system user is created and the image ends with `USER beer`.	2026-11-09 11:25:58 +10:00
hermes	9d3ce1d2c4	fix: build the image on Python 3.14 ... The image build failed on master: ERROR: Ignored the following versions that require a different python version: 4.19.0 Requires-Python >=3.11 ERROR: Could not find a version that satisfies the requirement pymongo==4.19.0 The base image was `python:3.10` but the pinned pymongo 4.19 needs Python >= 3.11. The image is now `python:3.14-slim` — the current stable release, so it is not carrying the CVEs fixed in 3.11, 3.12 and 3.13. All the runtime dependencies ship a cp314 wheel (pymongo included), so no compiler toolchain is needed. The old apt-get line installed libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev for packages that are no longer in the dependency list, so it is gone and the image is smaller. The build now asserts the interpreter version, so a base image change that breaks the pinned requirements fails the build with a clear message rather than a pip resolution error.	2026-11-09 11:23:22 +10:00
armistace	1470f0979a	initial	2024-09-07 23:24:32 +10:00