hermes
c0c6b4c1fc
Two follow-ups to the review of the base image change. 1. Pin the patch version: `python:3.14-slim` is a floating tag, so a rebuild could silently pick up a different base image. It is now `python:3.14.10-slim`, so a rebuild is reproducible. 2. Run the app as an unprivileged user. The app only reads its own source and talks to Mongo over the network — it writes no files — so it does not need to be root. A `beer` system user is created and the image ends with `USER beer`.
35 lines
1.2 KiB
Docker
35 lines
1.2 KiB
Docker
FROM git.aridgwayweb.com/armistace/beer_base_image AS flask
|
|
|
|
COPY requirements.txt .
|
|
|
|
ADD src /beer_data/src
|
|
|
|
# The app lives in src/flask and imports its siblings by bare name
|
|
# (``import brewing``), so that directory is the working directory.
|
|
WORKDIR /beer_data/src/flask
|
|
|
|
# Run as an unprivileged user. The app only needs to read its own source
|
|
# and talk to Mongo over the network — it writes no files — so it does not
|
|
# need to be root.
|
|
RUN useradd --system --create-home --home-dir /home/beer --shell /usr/sbin/nologin beer \
|
|
&& chown -R beer:beer /beer_data
|
|
|
|
# The app is served by waitress, not the Flask development server.
|
|
# FLASK_DEBUG stays OFF: the old entrypoint ran the Werkzeug debugger in
|
|
# production, which exposes an interactive console on any unhandled error.
|
|
ENV FLASK_ENV=production
|
|
ENV FLASK_DEBUG=0
|
|
ENV PORT=5000
|
|
|
|
# SECRET_KEY MUST be supplied by the deployment (see RUNBOOK.md). There is
|
|
# deliberately no default: the app refuses to start without a real one, so a
|
|
# misconfigured deployment fails loudly instead of running with a known
|
|
# session-signing key.
|
|
# ENV SECRET_KEY=...
|
|
|
|
USER beer
|
|
|
|
EXPOSE 5000
|
|
|
|
ENTRYPOINT ["python", "-m", "waitress", "--listen=0.0.0.0:5000", "--call", "beer_data:create_app"]
|