Upgrade to Python 3.13 and Alpine base image with multi-stage build

Author: Kevin Allioli

.github/workflows/docs.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install MkDocs + Material
         run: |

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install dependencies
         run: pip install -r requirements.txt cryptography pytest pytest-asyncio httpx
@@ -73,7 +73,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Build package
         run: pip install build && python -m build cli/

Dockerfile

@@ -1,4 +1,17 @@
-FROM python:3.12-slim
+# ── Stage 1: build dependencies ──────────────────────────────────────────────
+FROM python:3.13-alpine AS builder
+
+# Build deps needed to compile cryptography (Rust/C) and other native packages
+RUN apk add --no-cache gcc musl-dev libffi-dev openssl-dev cargo
+
+WORKDIR /build
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
+
+
+# ── Stage 2: runtime image ────────────────────────────────────────────────────
+FROM python:3.13-alpine
 
 # ── OCI image annotations ─────────────────────────────────────────────────────
 LABEL org.opencontainers.image.title="Ghostbit" \
@@ -9,29 +22,22 @@ LABEL org.opencontainers.image.title="Ghostbit" \
       org.opencontainers.image.vendor="StackOps HQ" \
       org.opencontainers.image.licenses="MIT"
 
-WORKDIR /app
+# Runtime deps only (no compiler, no Rust, no build tools)
+RUN apk add --no-cache libffi openssl
 
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+# Copy installed packages from builder
+COPY --from=builder /install /usr/local
 
+WORKDIR /app
 COPY . .
 
 RUN mkdir -p /data
 
 # ── Runtime configuration ─────────────────────────────────────────────────────
-# Storage backend: "sqlite" or "redis"
 ENV STORAGE_BACKEND=sqlite
-
-# SQLite database path (only used when STORAGE_BACKEND=sqlite)
 ENV SQLITE_PATH=/data/ghostbit.db
-
-# Redis connection URL (only used when STORAGE_BACKEND=redis)
 ENV REDIS_URL=redis://localhost:6379
-
-# Maximum paste size in bytes (default: 512 KB)
 ENV MAX_PASTE_SIZE=524288
-
-# Server port
 ENV PORT=8000
 
 EXPOSE ${PORT}

cli/pyproject.toml

@@ -22,6 +22,7 @@ classifiers = [
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
     "Topic :: Internet",
     "Topic :: Security :: Cryptography",
     "Topic :: Utilities",