Justin Wheeler
8eb262bfb4
The UBI 9 Python image runs as non-root (UID 1001). Poetry export wrote `requirements.txt` to `/app` which works in the builder stage but is fragile — the working directory inherits root-owned permissions from `COPY`. Writing to `/tmp` is the correct pattern for ephemeral build artifacts in non-root container images. Assisted-by: Claude Opus 4.6 (1M context) Signed-off-by: Justin Wheeler <jwheel@fedoraproject.org>
30 lines
1.1 KiB
Docker
30 lines
1.1 KiB
Docker
# Stage 1: Install dependencies in a temporary builder image.
|
|
# Uses Poetry to export a requirements.txt, then installs with pip
|
|
# to avoid Poetry/setuptools conflicts in the UBI container.
|
|
FROM registry.access.redhat.com/ubi9/python-312:latest AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml poetry.lock* ./
|
|
RUN pip install --no-cache-dir poetry poetry-plugin-export \
|
|
&& poetry export --without dev,docs -f requirements.txt -o /tmp/requirements.txt \
|
|
&& pip install --no-cache-dir -r /tmp/requirements.txt
|
|
|
|
# Stage 2: Create the final runtime image.
|
|
# Starts from a clean base and copies only the installed packages
|
|
# from the builder, producing a smaller image without build tools.
|
|
FROM registry.access.redhat.com/ubi9/python-312:latest
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder /opt/app-root /opt/app-root
|
|
COPY . /app
|
|
|
|
RUN python manage.py collectstatic --noinput 2>/dev/null || true
|
|
|
|
# Run as non-root user (required by OpenShift security context constraints)
|
|
USER 1001
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["gunicorn", "happinesspackets.wsgi:application", "--bind", "0.0.0.0:8000", "--workers", "3"]
|