Markus
d9b42e3432
Non-root, read-only-rootfs image with HOME/XDG_CACHE_HOME on /tmp so nothing writes outside /data and /tmp (§13a.3, §14.16).
39 lines
1.4 KiB
Docker
39 lines
1.4 KiB
Docker
# mdmem — build: podman build -t harbor.cloud.traunseenet.com/library/mdmem:0.1.0 -f Containerfile .
|
|
FROM docker.io/library/python:3.12-slim-bookworm AS build
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.5.18 /uv /usr/local/bin/uv
|
|
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
|
|
WORKDIR /app
|
|
|
|
# Dependencies first, so a source-only change does not re-resolve the world.
|
|
COPY pyproject.toml uv.lock README.md ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-install-project --no-dev
|
|
|
|
COPY src ./src
|
|
RUN --mount=type=cache,target=/root/.cache/uv uv sync --frozen --no-dev
|
|
|
|
# ---------------------------------------------------------------------------
|
|
FROM docker.io/library/python:3.12-slim-bookworm
|
|
|
|
# readOnlyRootFilesystem: true (§13a.3) — nothing may write outside /data and /tmp.
|
|
ENV HOME=/tmp \
|
|
XDG_CACHE_HOME=/tmp \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH="/app/.venv/bin:$PATH"
|
|
|
|
WORKDIR /app
|
|
COPY --from=build /app/.venv /app/.venv
|
|
COPY --from=build /app/src /app/src
|
|
|
|
# The sqlite-vec shared object ships inside the image and is loaded read-only (§14.16).
|
|
RUN /app/.venv/bin/python -c "import sqlite_vec, os; p = sqlite_vec.loadable_path(); \
|
|
assert os.path.exists(p + '.so') or os.path.exists(p), p; print('sqlite-vec at', p)"
|
|
|
|
USER 1000:1000
|
|
EXPOSE 8080 8081
|
|
VOLUME ["/data"]
|
|
ENTRYPOINT ["/app/.venv/bin/mdmem"]
|
|
CMD ["serve"]
|