update
This commit is contained in:
@@ -10,16 +10,22 @@ FROM python:3.12-slim-bookworm AS wheelhouse
|
|||||||
WORKDIR /wheels
|
WORKDIR /wheels
|
||||||
|
|
||||||
# Install build tools required for packages with C extensions
|
# Install build tools required for packages with C extensions
|
||||||
|
# RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
|
# gcc \
|
||||||
|
# g++ \
|
||||||
|
# make \
|
||||||
|
# libgl1 \
|
||||||
|
# libglib2.0-0 \
|
||||||
|
# libxcb1 \
|
||||||
|
# libx11-6 \
|
||||||
|
# libxext6 \
|
||||||
|
# libsm6 \
|
||||||
|
# && rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
gcc \
|
gcc \
|
||||||
g++ \
|
g++ \
|
||||||
make \
|
make \
|
||||||
libgl1 \
|
|
||||||
libglib2.0-0 \
|
|
||||||
libxcb1 \
|
|
||||||
libx11-6 \
|
|
||||||
libxext6 \
|
|
||||||
libsm6 \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
# Copy requirements first so this layer is cached unless deps change
|
# Copy requirements first so this layer is cached unless deps change
|
||||||
@@ -28,7 +34,7 @@ COPY backend /app/backend
|
|||||||
# FIX: Create an isolated venv to compile wheels so Kaniko doesn't corrupt global pip vendor files
|
# FIX: Create an isolated venv to compile wheels so Kaniko doesn't corrupt global pip vendor files
|
||||||
RUN python -m venv /opt/wheelhouse-env && \
|
RUN python -m venv /opt/wheelhouse-env && \
|
||||||
/opt/wheelhouse-env/bin/pip install --no-cache-dir --upgrade pip && \
|
/opt/wheelhouse-env/bin/pip install --no-cache-dir --upgrade pip && \
|
||||||
/opt/wheelhouse-env/bin/pip wheel --no-cache-dir --wheel-dir=/wheels -r requirements.txt
|
/opt/wheelhouse-env/bin/pip wheel --no-cache-dir --wheel-dir=/wheels --extra-index-url https://download.pytorch.org/whl/cpu -r requirements.txt
|
||||||
|
|
||||||
# =============================================================================
|
# =============================================================================
|
||||||
# Stage 2: Application Builder
|
# Stage 2: Application Builder
|
||||||
@@ -43,16 +49,22 @@ WORKDIR /app
|
|||||||
|
|
||||||
# Install build tools (kept for safety; wheels are pre-compiled but some
|
# Install build tools (kept for safety; wheels are pre-compiled but some
|
||||||
# packages may still invoke build steps during install)
|
# packages may still invoke build steps during install)
|
||||||
|
# RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
|
# gcc \
|
||||||
|
# g++ \
|
||||||
|
# make \
|
||||||
|
# libgl1 \
|
||||||
|
# libglib2.0-0 \
|
||||||
|
# libxcb1 \
|
||||||
|
# libx11-6 \
|
||||||
|
# libxext6 \
|
||||||
|
# libsm6 \
|
||||||
|
# && rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
gcc \
|
gcc \
|
||||||
g++ \
|
g++ \
|
||||||
make \
|
make \
|
||||||
libgl1 \
|
|
||||||
libglib2.0-0 \
|
|
||||||
libxcb1 \
|
|
||||||
libx11-6 \
|
|
||||||
libxext6 \
|
|
||||||
libsm6 \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
&& rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
# Create virtual environment so we can copy a single tree to runtime
|
# Create virtual environment so we can copy a single tree to runtime
|
||||||
@@ -69,8 +81,10 @@ COPY --from=wheelhouse /app/backend /app/backend
|
|||||||
# Install dependencies FROM LOCAL WHEELS ONLY (no network access needed)
|
# Install dependencies FROM LOCAL WHEELS ONLY (no network access needed)
|
||||||
# --no-index: do not query PyPI or any external index
|
# --no-index: do not query PyPI or any external index
|
||||||
# --find-links: use only the local wheelhouse at /wheels
|
# --find-links: use only the local wheelhouse at /wheels
|
||||||
RUN pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt
|
# RUN pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt
|
||||||
|
RUN pip install --no-cache-dir --no-index --find-links=/wheels -r requirements.txt && \
|
||||||
|
find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + && \
|
||||||
|
find /opt/venv -type d -name "tests" -exec rm -rf {} +
|
||||||
# =============================================================================
|
# =============================================================================
|
||||||
# Stage 3: Runtime
|
# Stage 3: Runtime
|
||||||
# Minimal image containing only the venv and application code.
|
# Minimal image containing only the venv and application code.
|
||||||
@@ -83,14 +97,14 @@ WORKDIR /app
|
|||||||
RUN groupadd -g 999 appgroup && \
|
RUN groupadd -g 999 appgroup && \
|
||||||
useradd -r -u 999 -g appgroup -d /app -s /sbin/nologin appuser
|
useradd -r -u 999 -g appgroup -d /app -s /sbin/nologin appuser
|
||||||
|
|
||||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
# RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||||
libgl1 \
|
# libgl1 \
|
||||||
libglib2.0-0 \
|
# libglib2.0-0 \
|
||||||
libxcb1 \
|
# libxcb1 \
|
||||||
libx11-6 \
|
# libx11-6 \
|
||||||
libxext6 \
|
# libxext6 \
|
||||||
libsm6 \
|
# libsm6 \
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
# && rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
|
||||||
# Step 3: Use the exact matching numeric IDs for --chown
|
# Step 3: Use the exact matching numeric IDs for --chown
|
||||||
@@ -100,6 +114,11 @@ ENV PATH=/opt/venv/bin:$PATH
|
|||||||
# Copy application code
|
# Copy application code
|
||||||
COPY --from=wheelhouse --chown=999:999 /app/backend /app/backend
|
COPY --from=wheelhouse --chown=999:999 /app/backend /app/backend
|
||||||
# Switch to non-root user
|
# Switch to non-root user
|
||||||
|
# === FIX COMPONENT ===
|
||||||
|
# Pre-create the log directory and hand ownership over to appuser
|
||||||
|
RUN mkdir -p /app/logs && chown -R 999:999 /app/logs
|
||||||
|
# =====================
|
||||||
|
|
||||||
USER appuser
|
USER appuser
|
||||||
|
|
||||||
# Expose port
|
# Expose port
|
||||||
|
|||||||
@@ -14,7 +14,7 @@ langchain==1.3.7
|
|||||||
langchain-text-splitters==1.1.2
|
langchain-text-splitters==1.1.2
|
||||||
modal==1.5.0
|
modal==1.5.0
|
||||||
numpy==2.1.3
|
numpy==2.1.3
|
||||||
opencv-python==4.13.0.92
|
opencv-python-headless==4.13.0.92
|
||||||
pgvector==0.4.2
|
pgvector==0.4.2
|
||||||
pillow>=10.0.0,<12.0.0
|
pillow>=10.0.0,<12.0.0
|
||||||
psycopg2-binary==2.9.12
|
psycopg2-binary==2.9.12
|
||||||
|
|||||||
Reference in New Issue
Block a user