hermes
c0c6b4c1fc
Two follow-ups to the review of the base image change. 1. Pin the patch version: `python:3.14-slim` is a floating tag, so a rebuild could silently pick up a different base image. It is now `python:3.14.10-slim`, so a rebuild is reproducible. 2. Run the app as an unprivileged user. The app only reads its own source and talks to Mongo over the network — it writes no files — so it does not need to be root. A `beer` system user is created and the image ends with `USER beer`.
27 lines
1.1 KiB
Docker
27 lines
1.1 KiB
Docker
FROM python:3.14.10-slim AS beer_base_image
|
|
|
|
WORKDIR /beer_data
|
|
|
|
COPY requirements.txt .
|
|
|
|
# The runtime dependencies (flask, flask-wtf, waitress, pymongo, requests) all
|
|
# ship as wheels for 3.14, so no compiler toolchain is needed. The old image
|
|
# installed libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev
|
|
# for packages that are no longer in the dependency list.
|
|
#
|
|
# The Python version matters:
|
|
# - pymongo 4.19 requires Python >= 3.11, so the base image could not stay
|
|
# on 3.10 once the requirements were pinned.
|
|
# - 3.14 is a stable release (first released 2025-10-07, in its bugfix
|
|
# phase until 2030-10), so the image is not carrying the CVEs fixed in
|
|
# 3.11, 3.12 and 3.13.
|
|
# - The patch version is pinned rather than the floating `3.14-slim` tag so
|
|
# a rebuild is reproducible and does not silently pick up a base image
|
|
# change.
|
|
RUN pip install --upgrade pip --no-cache-dir
|
|
|
|
RUN pip --default-timeout=1000 install --no-cache-dir -r requirements.txt
|
|
|
|
# Fail the build if the interpreter is not the one the image claims.
|
|
RUN python -c "import sys; assert sys.version_info[:2] == (3, 14), sys.version"
|