feat(docker): add Dockerfile.11_final_v2 with hardened, reproducible … #74
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…FastAPI build This commit introduces Dockerfile.11_final_v2, a fully optimized, secure, and deterministic multi‑stage build for the FastAPI service. Key improvements and changes: - Uses pinned digest base images (python:bookworm@sha256 and slim@sha256) for deterministic, reproducible builds. - Introduces Tini as PID 1 for proper signal forwarding and process reaping. - Builds dependencies via Astral UV for faster, locked, and cached installs. - Enforces non‑root numeric user (UID/GID 10000) for runtime safety. - Moves all DB and secret configuration to runtime environment variables instead of build‑time arguments. - Integrates a lightweight `docker-entrypoint.sh` for dynamic env expansion and clean signal handling. - Sets strict runtime hardening: --read-only, --tmpfs /tmp, --cap-drop=ALL, --security-opt no-new-privileges:true. - Adds OCI metadata labels (build date, revision, description) for traceability. - Supports reproducible dependency manifest (`dependencies.txt`) for auditability. - Enables healthcheck route compatibility with configurable APP_PORT.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi, I'm watching more videos and having more fun. I've added a version that is closer to my prod version.
This commit introduces Dockerfile.11_final_v2, a fully optimized, secure, and deterministic multi‑stage build for the FastAPI service.
Key improvements and changes:
docker-entrypoint.shfor dynamic env expansion and clean signal handling.dependencies.txt) for auditability.