commops/fedora-happiness-packets
15
1
Fork 0
Code Issues 10 Pull requests 3 Releases 1 Packages Activity Actions

🐛 Containerfile: Write requirements to /tmp in builder stage

Browse source 
The UBI 9 Python image runs as non-root (UID 1001). Poetry export wrote
`requirements.txt` to `/app` which works in the builder stage but is
fragile — the working directory inherits root-owned permissions from
`COPY`. Writing to `/tmp` is the correct pattern for ephemeral build
artifacts in non-root container images.

Assisted-by: Claude Opus 4.6 (1M context)
Signed-off-by: Justin Wheeler <jwheel@fedoraproject.org>
This commit is contained in:
Justin Wheeler 2026-05-10 16:00:40 +02:00
commit 8eb262bfb4
Signed by: jflory7
GPG key ID: 6BD803B36BF8F62E
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Containerfile
View file

@ -7,8 +7,8 @@ WORKDIR /app
COPY pyproject.toml poetry.lock* ./
RUN pip install --no-cache-dir poetry poetry-plugin-export \
&& poetry export --without dev,docs -f requirements.txt -o requirements.txt \
&& pip install --no-cache-dir -r requirements.txt
&& poetry export --without dev,docs -f requirements.txt -o /tmp/requirements.txt \
&& pip install --no-cache-dir -r /tmp/requirements.txt
# Stage 2: Create the final runtime image.
# Starts from a clean base and copies only the installed packages