Adriano
d1833ba203
Punto 1: useradd -u 10001 app, chown /app (+ /app/uploads sul server), USER app in tutti e tre i Dockerfile. Stesso UID sul server e sul worker di visione, che condividono il volume uploads in sola lettura (punto 13). Punto 2: python:3.11.16-slim (server, client), python:3.13.15-slim (vision), ghcr.io/astral-sh/uv:0.10.9 (versione locale di `uv --version`). Dockerfile.frontend: TailwindCSS ora si compila in uno stage separato dall'immagine ufficiale node:20.20.2-bookworm-slim, non più con `curl | bash` su nodesource nell'immagine finale. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
47 lines
1.4 KiB
Docker
47 lines
1.4 KiB
Docker
FROM python:3.11.16-slim AS base
|
|
|
|
# Install uv (fast Python package manager) from official slim image.
|
|
COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /uvx /usr/local/bin/
|
|
|
|
# System libs required by WeasyPrint at runtime.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libpango-1.0-0 \
|
|
libpangocairo-1.0-0 \
|
|
libcairo2 \
|
|
libgdk-pixbuf-2.0-0 \
|
|
libffi-dev \
|
|
shared-mime-info \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user the app runs as at runtime.
|
|
RUN useradd -u 10001 app
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy lockfile + project metadata first to maximize Docker layer cache.
|
|
COPY pyproject.toml uv.lock ./
|
|
COPY .python-version ./
|
|
|
|
# Install ONLY backend deps from the locked dependencies. --frozen ensures
|
|
# we never resolve at build time; --no-dev keeps the image lean.
|
|
RUN uv sync --frozen --no-dev --extra server
|
|
|
|
# Now copy the actual sources.
|
|
COPY src/ ./src/
|
|
|
|
# Uploads directory (mounted as a volume in production).
|
|
RUN mkdir -p /app/uploads/images /app/uploads/pdfs /app/uploads/logos /app/uploads/reports \
|
|
&& chown -R app:app /app
|
|
|
|
USER app
|
|
|
|
EXPOSE 8000
|
|
|
|
# Entry point: run Alembic migrations then start Uvicorn through uv so
|
|
# it uses the pinned interpreter and venv from `uv sync`.
|
|
CMD ["sh", "-c", \
|
|
"uv run alembic -c src/backend/migrations/alembic.ini upgrade head && \
|
|
uv run uvicorn src.backend.main:app \
|
|
--host 0.0.0.0 --port 8000 --workers 4 \
|
|
--proxy-headers --forwarded-allow-ips='*'"]
|