update
This commit is contained in:
@@ -10,16 +10,22 @@ FROM python:3.12-slim-bookworm AS wheelhouse
|
||||
WORKDIR /wheels
|
||||
|
||||
# Install build tools required for packages with C extensions
|
||||
# RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
# gcc \
|
||||
# g++ \
|
||||
# make \
|
||||
# libgl1 \
|
||||
# libglib2.0-0 \
|
||||
# libxcb1 \
|
||||
# libx11-6 \
|
||||
# libxext6 \
|
||||
# libsm6 \
|
||||
# && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
gcc \
|
||||
g++ \
|
||||
make \
|
||||
libgl1 \
|
||||
libglib2.0-0 \
|
||||
libxcb1 \
|
||||
libx11-6 \
|
||||
libxext6 \
|
||||
libsm6 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Copy requirements first so this layer is cached unless deps change
|
||||
@@ -28,7 +34,7 @@ COPY backend /app/backend
|
||||
# FIX: Create an isolated venv to compile wheels so Kaniko doesn't corrupt global pip vendor files
|
||||
RUN python -m venv /opt/wheelhouse-env && \
|
||||
/opt/wheelhouse-env/bin/pip install --no-cache-dir --upgrade pip && \
|
||||
/opt/wheelhouse-env/bin/pip wheel --no-cache-dir --wheel-dir=/wheels -r requirements.txt
|
||||
/opt/wheelhouse-env/bin/pip wheel --no-cache-dir --wheel-dir=/wheels --extra-index-url https://download.pytorch.org/whl/cpu -r requirements.txt
|
||||
|
||||
# =============================================================================
|
||||
# Stage 2: Application Builder
|
||||
@@ -43,16 +49,22 @@ WORKDIR /app
|
||||
|
||||
# Install build tools (kept for safety; wheels are pre-compiled but some
|
||||
# packages may still invoke build steps during install)
|
||||
# RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
# gcc \
|
||||
# g++ \
|
||||
# make \
|
||||
# libgl1 \
|
||||
# libglib2.0-0 \
|
||||
# libxcb1 \
|
||||
# libx11-6 \
|
||||
# libxext6 \
|
||||
# libsm6 \
|
||||
# && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
gcc \
|
||||
g++ \
|
||||
make \
|
||||
libgl1 \
|
||||
libglib2.0-0 \
|
||||
libxcb1 \
|
||||
libx11-6 \
|
||||
libxext6 \
|
||||
libsm6 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Create virtual environment so we can copy a single tree to runtime
|
||||
@@ -69,8 +81,10 @@ COPY --from=wheelhouse /app/backend /app/backend
|
||||
# Install dependencies FROM LOCAL WHEELS ONLY (no network access needed)
|
||||
# --no-index: do not query PyPI or any external index
|
||||
# --find-links: use only the local wheelhouse at /wheels
|
||||
RUN pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt
|
||||
|
||||
# RUN pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt
|
||||
RUN pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt && \
|
||||
find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + && \
|
||||
find /opt/venv -type d -name "tests" -exec rm -rf {} +
|
||||
# =============================================================================
|
||||
# Stage 3: Runtime
|
||||
# Minimal image containing only the venv and application code.
|
||||
@@ -83,14 +97,14 @@ WORKDIR /app
|
||||
RUN groupadd -g 999 appgroup && \
|
||||
useradd -r -u 999 -g appgroup -d /app -s /sbin/nologin appuser
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
libgl1 \
|
||||
libglib2.0-0 \
|
||||
libxcb1 \
|
||||
libx11-6 \
|
||||
libxext6 \
|
||||
libsm6 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
# RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
# libgl1 \
|
||||
# libglib2.0-0 \
|
||||
# libxcb1 \
|
||||
# libx11-6 \
|
||||
# libxext6 \
|
||||
# libsm6 \
|
||||
# && rm -rf /var/lib/apt/lists/*
|
||||
|
||||
|
||||
# Step 3: Use the exact matching numeric IDs for --chown
|
||||
@@ -100,6 +114,11 @@ ENV PATH=/opt/venv/bin:$PATH
|
||||
# Copy application code
|
||||
COPY --from=wheelhouse --chown=999:999 /app/backend /app/backend
|
||||
# Switch to non-root user
|
||||
# === FIX COMPONENT ===
|
||||
# Pre-create the log directory and hand ownership over to appuser
|
||||
RUN mkdir -p /app/logs && chown -R 999:999 /app/logs
|
||||
# =====================
|
||||
|
||||
USER appuser
|
||||
|
||||
# Expose port
|
||||
|
||||
@@ -14,7 +14,7 @@ langchain==1.3.7
|
||||
langchain-text-splitters==1.1.2
|
||||
modal==1.5.0
|
||||
numpy==2.1.3
|
||||
opencv-python==4.13.0.92
|
||||
opencv-python-headless==4.13.0.92
|
||||
pgvector==0.4.2
|
||||
pillow>=10.0.0,<12.0.0
|
||||
psycopg2-binary==2.9.12
|
||||
|
||||
Reference in New Issue
Block a user