base.Dockerfile

@@ -1,11 +1,22 @@
-FROM python:3.10 AS beer_base_image
+FROM python:3.14-slim AS beer_base_image
 
 WORKDIR /beer_data
 
 COPY requirements.txt .
 
-RUN apt-get update -y && apt-get upgrade -y && apt-get install -y libsasl2-dev python-dev-is-python3 libldap2-dev libssl-dev
+# The runtime dependencies (flask, flask-wtf, waitress, pymongo, requests) all
+# ship as wheels for 3.14, so no compiler toolchain is needed.  The old image
+# installed libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev
+# for packages that are no longer in the dependency list.
+#
+# The Python version matters:
+#   - pymongo 4.19 requires Python >= 3.11, so the base image could not stay
+#     on 3.10 once the requirements were pinned.
+#   - 3.14 is the current stable release, so the image is not carrying the
+#     CVEs fixed in 3.11, 3.12 and 3.13.
+RUN pip install --upgrade pip --no-cache-dir
 
-RUN pip install --upgrade pip
+RUN pip --default-timeout=1000 install --no-cache-dir -r requirements.txt
 
-RUN pip --default-timeout=1000 install -r requirements.txt
+# Fail the build if the interpreter is not the one the image claims.
+RUN python -c "import sys; assert sys.version_info[:2] == (3, 14), sys.version"