forked from COATnor/coat2pycsw
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Improve packages management - Improve non-root security
- Loading branch information
Showing
6 changed files
with
51 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,11 @@ | ||
FROM python:3.11.5-slim-bullseye | ||
LABEL maintainer="[email protected]" | ||
|
||
# Production non-root user | ||
ENV USERNAME=ckan-pycsw | ||
ENV USER_UID=10001 | ||
ENV USER_GID=$USER_UID | ||
# ckan-pycsw envvars | ||
ENV APP_DIR=/app | ||
ENV TZ=UTC | ||
RUN echo ${TZ} > /etc/timezone | ||
|
@@ -13,14 +18,19 @@ ENV DEV_MODE=False | |
ENV TIMEOUT=300 | ||
ENV PYCSW_CRON_DAYS_INTERVAL=2 | ||
|
||
RUN apt-get -q -y update && \ | ||
apt-get install -y wget && \ | ||
WORKDIR ${APP_DIR} | ||
|
||
RUN groupadd --gid $USER_GID $USERNAME \ | ||
&& useradd --uid $USER_UID --gid $USER_GID -m $USERNAME && \ | ||
chown -R $USERNAME:$USERNAME $APP_DIR && \ | ||
apt-get -q -y update && apt-get install -y \ | ||
wget && \ | ||
DEBIAN_FRONTEND=noninteractive apt-get -yq install gettext-base && \ | ||
wget -O /wait-for https://raw.githubusercontent.com/eficode/wait-for/v2.2.3/wait-for && \ | ||
chmod +x /wait-for && \ | ||
python3 -m pip install pdm | ||
python3 -m pip install pdm && \ | ||
rm -rf /var/lib/apt/lists/* | ||
|
||
WORKDIR ${APP_DIR} | ||
COPY pyproject.toml pdm.lock ./ | ||
|
||
RUN pdm install --no-self --group prod | ||
|
@@ -30,5 +40,7 @@ COPY ckan2pycsw ckan2pycsw | |
|
||
EXPOSE ${PYCSW_PORT}/TCP | ||
|
||
USER $USERNAME | ||
|
||
ENTRYPOINT ["/bin/bash", "./entrypoint.sh"] | ||
CMD ["tail", "-f", "/dev/null"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,11 @@ | ||
FROM python:3.11.5-slim-bullseye | ||
LABEL maintainer="[email protected]" | ||
|
||
# Production non-root user | ||
ENV USERNAME=ckan-pycsw | ||
ENV USER_UID=10001 | ||
ENV USER_GID=$USER_UID | ||
# ckan-pycsw envvars | ||
ENV APP_DIR=/app | ||
ENV TZ=UTC | ||
RUN echo ${TZ} > /etc/timezone | ||
|
@@ -13,14 +18,17 @@ ENV DEV_MODE=True | |
ENV PYCSW_DEV_PORT=5678 | ||
ENV TIMEOUT=300 | ||
|
||
RUN apt-get -q -y update && \ | ||
apt-get install -y wget procps && \ | ||
RUN apt-get -q -y update && apt-get install -y \ | ||
wget \ | ||
procps && \ | ||
DEBIAN_FRONTEND=noninteractive apt-get -yq install gettext-base && \ | ||
wget -O /wait-for https://raw.githubusercontent.com/eficode/wait-for/v2.2.4/wait-for && \ | ||
chmod +x /wait-for && \ | ||
python3 -m pip install pdm debugpy | ||
python3 -m pip install pdm debugpy && \ | ||
rm -rf /var/lib/apt/lists/* | ||
|
||
WORKDIR ${APP_DIR} | ||
|
||
COPY pyproject.toml pdm.lock ./ | ||
|
||
RUN pdm install --no-self --group prod | ||
|
@@ -31,6 +39,8 @@ COPY ckan2pycsw ckan2pycsw | |
EXPOSE ${PYCSW_PORT}/TCP | ||
EXPOSE ${PYCSW_DEV_PORT}/TCP | ||
|
||
USER $USERNAME | ||
|
||
# Set entrypoint with debugpy | ||
ENTRYPOINT ["/bin/bash", "-c", "python3 -m debugpy --listen 0.0.0.0:${PYCSW_DEV_PORT} --wait-for-client ./entrypoint_dev.sh"] | ||
CMD ["pdm", "run", "python3", "-m", "gunicorn", "pycsw.wsgi:application", "-b", "0.0.0.0:${PYCSW_PORT}"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,11 @@ | ||
FROM ghcr.io/mjanez/ckan-pycsw:latest | ||
LABEL maintainer="[email protected]" | ||
|
||
# Production non-root user | ||
ENV USERNAME=ckan-pycsw | ||
ENV USER_UID=10001 | ||
ENV USER_GID=$USER_UID | ||
# ckan-pycsw envvars | ||
ENV APP_DIR=/app | ||
ENV TZ=UTC | ||
RUN echo ${TZ} > /etc/timezone | ||
|
@@ -17,4 +22,6 @@ WORKDIR ${APP_DIR} | |
|
||
COPY ckan-pycsw/conf/pycsw.conf.template ckan-pycsw/docker-entrypoint.d/entrypoint.sh ./ | ||
|
||
USER $USERNAME | ||
|
||
ENTRYPOINT ["/bin/bash", "./entrypoint.sh"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,11 @@ | ||
FROM ghcr.io/mjanez/ckan-pycsw-dev:latest | ||
LABEL maintainer="[email protected]" | ||
|
||
# Production non-root user | ||
ENV USERNAME=ckan-pycsw | ||
ENV USER_UID=10001 | ||
ENV USER_GID=$USER_UID | ||
# ckan-pycsw envvars | ||
ENV APP_DIR=/app | ||
ENV TZ=UTC | ||
RUN echo ${TZ} > /etc/timezone | ||
|
@@ -20,6 +25,8 @@ COPY ckan-pycsw/conf/pycsw.conf.template ckan-pycsw/docker-entrypoint.d/entrypoi | |
EXPOSE ${PYCSW_PORT}/TCP | ||
EXPOSE ${PYCSW_DEV_PORT}/TCP | ||
|
||
USER $USERNAME | ||
|
||
# Set entrypoint with debugpy | ||
ENTRYPOINT ["/bin/bash", "-c", "python3 -m debugpy --listen 0.0.0.0:${PYCSW_DEV_PORT} --wait-for-client ./entrypoint_dev.sh"] | ||
CMD ["pdm", "run", "python3", "-m", "gunicorn", "pycsw.wsgi:application", "-b", "0.0.0.0:${PYCSW_PORT}"] |