sakshamandClaude Sonnet 5
820787c7bf
COPY --chown fixes the files being copied in, but WORKDIR had already created /app as root beforehand - the directory entry itself stayed root:root (no write bit for appuser), so celery beat's schedule-file write still failed with Permission denied even after the earlier --chown fix. Confirmed live on the actual deployment (local testing hadn't caught this). Co-Authored-By: Claude Sonnet 5 <[email protected]>
49 lines
1.4 KiB
Docker
49 lines
1.4 KiB
Docker
# Production image for api/worker/beat - no bind mounts, no --reload, no
|
|
# dev-only dependencies. See infrastructure/docker/api.Dockerfile for the
|
|
# dev image (kept separate and untouched).
|
|
|
|
FROM python:3.12-slim AS builder
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN python -m venv /venv
|
|
ENV PATH="/venv/bin:$PATH"
|
|
|
|
COPY apps/api /app
|
|
RUN pip install --upgrade pip && pip install .
|
|
|
|
|
|
FROM python:3.12-slim AS runtime
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH="/venv/bin:$PATH"
|
|
|
|
RUN useradd --create-home --uid 1000 appuser
|
|
|
|
WORKDIR /app
|
|
COPY --from=builder /venv /venv
|
|
# --chown fixes the *contents* being copied, but WORKDIR above already
|
|
# created /app itself as root beforehand - COPY --chown doesn't retroactively
|
|
# fix a pre-existing directory's own ownership, only what it copies into it.
|
|
# Confirmed live: celery beat writing its schedule file (celerybeat-schedule)
|
|
# directly into /app failed with "Permission denied" even with --chown here,
|
|
# because /app itself was still root:root (mode 755, no write bit for
|
|
# appuser). The explicit chown below fixes the directory entry itself.
|
|
COPY --chown=appuser:appuser apps/api /app
|
|
RUN chown appuser:appuser /app
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
|