Adriano
d1833ba203
Punto 1: useradd -u 10001 app, chown /app (+ /app/uploads sul server), USER app in tutti e tre i Dockerfile. Stesso UID sul server e sul worker di visione, che condividono il volume uploads in sola lettura (punto 13). Punto 2: python:3.11.16-slim (server, client), python:3.13.15-slim (vision), ghcr.io/astral-sh/uv:0.10.9 (versione locale di `uv --version`). Dockerfile.frontend: TailwindCSS ora si compila in uno stage separato dall'immagine ufficiale node:20.20.2-bookworm-slim, non più con `curl | bash` su nodesource nell'immagine finale. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
49 lines
2.0 KiB
Docker
49 lines
2.0 KiB
Docker
FROM python:3.13.15-slim
|
|
|
|
# opencv-python (pulled in transitively by vs-core/vs-task/vs-measure/vs-pm2d)
|
|
# needs libGL and glib at runtime even though it is never imported by name here.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libgl1 libglib2.0-0 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.10.9 /uv /usr/local/bin/uv
|
|
|
|
# Non-root user the app runs as at runtime. Same UID as the server's Dockerfile
|
|
# so both containers agree on ownership of the shared uploads volume (point 13).
|
|
RUN useradd -u 10001 app
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml uv.lock ./
|
|
COPY vendor/ ./vendor/
|
|
RUN uv sync --extra vision-worker --frozen --no-dev
|
|
|
|
COPY src/vision/ ./src/vision/
|
|
COPY src/vision_worker/ ./src/vision_worker/
|
|
|
|
# Ruling R8: the version is stamped at build time, not discovered at runtime.
|
|
# COPY vendor/ above does not bring vendor/visionsuite/.git along - it is a
|
|
# gitlink file pointing at ../../.git/modules/vendor/visionsuite, which lives
|
|
# outside the build context - so `git rev-parse HEAD` cannot work in here.
|
|
# Pass the submodule's commit in from the host, which does have git:
|
|
# VISION_ENGINE_VERSION=$(git -C vendor/visionsuite rev-parse HEAD) \
|
|
# docker compose build vision
|
|
ARG VISION_ENGINE_VERSION
|
|
# I4: a build without the commit must fail now, at build time - not later, at
|
|
# every request including /health, with a container Docker still reports as
|
|
# healthy because no healthcheck existed to say otherwise.
|
|
RUN test -n "$VISION_ENGINE_VERSION" || { \
|
|
echo "VISION_ENGINE_VERSION is required. Build with:"; \
|
|
echo ' VISION_ENGINE_VERSION=$(git -C vendor/visionsuite rev-parse HEAD) docker compose build vision'; \
|
|
exit 1; \
|
|
}
|
|
ENV VISION_ENGINE_VERSION=${VISION_ENGINE_VERSION}
|
|
|
|
RUN chown -R app:app /app
|
|
USER app
|
|
|
|
EXPOSE 8100
|
|
|
|
# Two workers, not four: each holds the vision stack in memory.
|
|
CMD ["uv", "run", "uvicorn", "src.vision_worker.main:app", \
|
|
"--host", "0.0.0.0", "--port", "8100", "--workers", "2"]
|