backend/Dockerfile at main · guitar0-net/backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
# SPDX-FileCopyrightText: 2026 Andrey Kotlyar <[email protected]>
#
# SPDX-License-Identifier: AGPL-3.0-or-later

# Stage 1: Builder
FROM python:3.14.6-slim AS builder

WORKDIR /app

# Upgrade pip to fix known vulnerabilities, then install PDM
RUN pip install --no-cache-dir "pip==26.1.2" && pip install --no-cache-dir pdm

# Copy dependency files
COPY pyproject.toml pdm.lock ./

# Export dependencies to requirements.txt (production only, no dev/test)
RUN pdm export --no-hashes -o requirements.txt --prod

# Stage 2: Production
FROM python:3.14.6-slim AS production

# Build arguments for versioning
ARG VERSION=unknown
ARG GIT_SHA=unknown
ARG BUILD_DATETIME=unknown

# Environment variables
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONFAULTHANDLER=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    VERSION=${VERSION} \
    GIT_SHA=${GIT_SHA} \
    BUILD_DATETIME=${BUILD_DATETIME}

WORKDIR /app

# Install system dependencies (libpango/cairo required by WeasyPrint)
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpq5 \
    curl \
    libpango-1.0-0 \
    libpangoft2-1.0-0 \
    libpangocairo-1.0-0 \
    libcairo2 \
    libgdk-pixbuf-2.0-0 \
    shared-mime-info \
    fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user
RUN groupadd --gid 1001 appuser \
    && useradd --uid 1001 --gid 1001 --shell /bin/bash --create-home appuser

# Copy requirements from builder
COPY --from=builder /app/requirements.txt .

# Upgrade pip to fix known vulnerabilities, then install dependencies
RUN pip install --no-cache-dir "pip==26.1.2" && pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY --chown=appuser:appuser manage.py ./
COPY --chown=appuser:appuser config/ ./config/
COPY --chown=appuser:appuser apps/ ./apps/

# Create directories for static files and logs
RUN mkdir -p /app/staticfiles /app/logs \
    && chown -R appuser:appuser /app/staticfiles /app/logs

# Switch to non-root user
USER appuser

# Expose port
EXPOSE 8000

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8000/metrics/ || exit 1

CMD ["gunicorn", "--config", "config/gunicorn.py", "config.wsgi:application"]