Daniil
93 lines
3.6 KiB
Docker
93 lines
3.6 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 1: base — system dependencies shared by dev and prod
|
|
# ---------------------------------------------------------------------------
|
|
FROM python:3.11-slim AS base
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.8.15 /uv /uvx /bin/
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH="/app/.venv/bin:${PATH}"
|
|
|
|
WORKDIR /app
|
|
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
ffmpeg \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 2: deps — install Python dependencies (no project code)
|
|
# This layer is cached as long as pyproject.toml and uv.lock don't change.
|
|
# build-essential is needed here for compiling C extensions (e.g. psycopg2)
|
|
# but is NOT carried into the prod stage (prod inherits from base instead).
|
|
# ---------------------------------------------------------------------------
|
|
FROM base AS deps
|
|
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-install-project
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 3: dev — development target (used by docker-compose)
|
|
#
|
|
# Does NOT install the cpv3 package into site-packages at all. The source
|
|
# code is bind-mounted from the host at /app/cpv3, and Python finds it via
|
|
# sys.path (WORKDIR /app is on sys.path by default for scripts run from /app).
|
|
# This means:
|
|
# - No second `uv sync` step that could go stale or conflict with the mount
|
|
# - Hot reload works because uvicorn watches the bind-mounted directory
|
|
# - No risk of importing a stale copy from site-packages
|
|
# ---------------------------------------------------------------------------
|
|
FROM deps AS dev
|
|
|
|
# Without `uv sync` (which creates an editable .pth finder in site-packages),
|
|
# Python cannot find the cpv3 package. PYTHONPATH=/app makes /app/cpv3
|
|
# discoverable as a regular package. This is the standard approach for
|
|
# development containers with bind-mounted source code.
|
|
ENV PYTHONPATH=/app
|
|
|
|
# watchfiles is already included via uvicorn[standard] in main deps.
|
|
# It is used by uvicorn --reload and by the worker auto-restart wrapper.
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["sh", "-c", "alembic upgrade head && uvicorn cpv3.main:app --host 0.0.0.0 --port 8000 --reload --reload-dir /app/cpv3"]
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Stage 4: prod — production target (used by CI/CD image builds)
|
|
#
|
|
# Inherits from base (not deps) so build-essential is excluded from the
|
|
# final image (~200MB savings). Pre-compiled .venv is copied from deps.
|
|
# Runs as non-root user for container security.
|
|
# ---------------------------------------------------------------------------
|
|
FROM base AS prod
|
|
|
|
ENV UV_LINK_MODE=copy
|
|
|
|
COPY --from=deps /app/.venv /app/.venv
|
|
COPY pyproject.toml uv.lock ./
|
|
COPY cpv3 ./cpv3
|
|
COPY alembic ./alembic
|
|
COPY alembic.ini ./
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev
|
|
|
|
RUN groupadd --gid 1000 app && \
|
|
useradd --uid 1000 --gid app --create-home app
|
|
RUN chown -R app:app /app
|
|
USER app
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["sh", "-c", "alembic upgrade head && uvicorn cpv3.main:app --host 0.0.0.0 --port 8000"]
|