mirror of
https://gitverse.ru/kpa39l/md2vk.git
synced 2026-09-29 18:05:04 +00:00
estorozhenko
32 lines
985 B
Docker
32 lines
985 B
Docker
FROM python:3.12-slim AS builder
|
|
|
|
WORKDIR /app
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
FROM python:3.12-slim
|
|
|
|
WORKDIR /app
|
|
|
|
# Только бинарники и зависимости — без сборщика
|
|
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
|
|
COPY --from=builder /usr/local/bin /usr/local/bin
|
|
|
|
COPY app/ app/
|
|
COPY .env.example .env
|
|
|
|
# Read-only rootfs — только /data для БД и /logs для аудита
|
|
RUN mkdir -p /data /logs && chmod 755 /data /logs
|
|
|
|
# Не root
|
|
RUN useradd -m -u 1000 md2vk && chown -R md2vk:md2vk /app /data /logs
|
|
USER md2vk
|
|
|
|
EXPOSE 8420
|
|
|
|
# Ключ шифрования — через Docker secret /run/secrets/token_encryption_key
|
|
ENV TOKEN_ENCRYPTION_KEY_FILE=/run/secrets/token_encryption_key
|
|
ENV DATABASE_URL=sqlite+aiosqlite:////data/md2vk.db
|
|
ENV AUDIT_LOG_DIR=/logs
|
|
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8420"] |