From 8eb262bfb49620a45098bb342d5650d67e4cc3dd Mon Sep 17 00:00:00 2001 From: Justin Wheeler Date: Sun, 10 May 2026 16:00:40 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Containerfile:=20Write=20require?= =?UTF-8?q?ments=20to=20`/tmp`=20in=20builder=20stage?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The UBI 9 Python image runs as non-root (UID 1001). Poetry export wrote `requirements.txt` to `/app` which works in the builder stage but is fragile — the working directory inherits root-owned permissions from `COPY`. Writing to `/tmp` is the correct pattern for ephemeral build artifacts in non-root container images. Assisted-by: Claude Opus 4.6 (1M context) Signed-off-by: Justin Wheeler --- Containerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Containerfile b/Containerfile index 58b54ef..8a6b2f1 100644 --- a/Containerfile +++ b/Containerfile @@ -7,8 +7,8 @@ WORKDIR /app COPY pyproject.toml poetry.lock* ./ RUN pip install --no-cache-dir poetry poetry-plugin-export \ - && poetry export --without dev,docs -f requirements.txt -o requirements.txt \ - && pip install --no-cache-dir -r requirements.txt + && poetry export --without dev,docs -f requirements.txt -o /tmp/requirements.txt \ + && pip install --no-cache-dir -r /tmp/requirements.txt # Stage 2: Create the final runtime image. # Starts from a clean base and copies only the installed packages