trex/portfolio-hub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(container): harden v0.1.1 publication

Browse Source
This commit is contained in:
genichin
2026-08-15 15:14:36 +09:00
parent fd080496b3
commit 9c8baac70b
14 changed files with 287 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+12 -7
View File
@@ -1,23 +1,28 @@
# syntax=docker/dockerfile:1
FROM ghcr.io/astral-sh/uv:0.11.14 AS uv
FROM python:3.11-slim AS build
# syntax=docker/dockerfile:1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32
FROM ghcr.io/astral-sh/uv:0.11.14@sha256:1025398289b62de8269e70c45b91ffa37c373f38118d7da036fb8bb8efc85d97 AS uv
FROM python:3.11-slim@sha256:a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1 AS build
ARG SOURCE_COMMIT
ARG RELEASE_VERSION
WORKDIR /opt/portfolio-hub
RUN test "${#SOURCE_COMMIT}" -eq 40 && case "${SOURCE_COMMIT}" in *[!0-9a-f]*) false;; *) true;; esac \
|| { echo "SOURCE_COMMIT must be a 40-character lowercase commit" >&2; exit 1; }
&& printf '%s' "${RELEASE_VERSION}" | grep -Eq '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' \
|| { echo "SOURCE_COMMIT and strict RELEASE_VERSION=vX.Y.Z are required" >&2; exit 1; }
COPY --from=uv /uv /usr/local/bin/uv
COPY pyproject.toml uv.lock README.md ./
COPY app/ ./app/
RUN uv sync --locked --no-dev --no-editable
FROM python:3.11-slim AS runtime
FROM python:3.11-slim@sha256:a630a63cdb314e2d138a2fca3e375e319e8568346ffafac5b980f888630ac4f1 AS runtime
ARG SOURCE_COMMIT
ARG RELEASE_VERSION
LABEL org.opencontainers.image.source="https://github.com/fourblocks2020/portfolio-hub" \
org.opencontainers.image.revision="${SOURCE_COMMIT}"
org.opencontainers.image.revision="${SOURCE_COMMIT}" \
org.opencontainers.image.version="${RELEASE_VERSION}"
RUN test "${#SOURCE_COMMIT}" -eq 40 && case "${SOURCE_COMMIT}" in *[!0-9a-f]*) false;; *) true;; esac \
&& printf '%s' "${RELEASE_VERSION}" | grep -Eq '^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$' \
&& groupadd --gid 10001 portfoliohub \
&& useradd --uid 10001 --gid 10001 --create-home --shell /usr/sbin/nologin portfoliohub \
|| { echo "SOURCE_COMMIT must be a 40-character lowercase commit" >&2; exit 1; }
|| { echo "SOURCE_COMMIT and strict RELEASE_VERSION=vX.Y.Z are required" >&2; exit 1; }
WORKDIR /opt/portfolio-hub
COPY --from=build /opt/portfolio-hub/.venv ./.venv
ENV PATH="/opt/portfolio-hub/.venv/bin:${PATH}" PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1