diff --git a/Dockerfile b/Dockerfile index eb5d48c..9622f4f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,12 +1,11 @@ FROM alpine:latest -ARG USER=notroot -ARG GROUP=notroot +ARG USER=nonroot +ARG GROUP=nonroot ARG UID=1000 ARG GID=1000 COPY requirements.txt /tmp/requirements.txt -COPY ./entrypoint.sh /usr/bin/entrypoint.sh RUN set -xe && \ echo $(echo BUILD_TIME_ALPINE_VERSION: && /bin/cat /etc/alpine-release) && \ apk upgrade --no-cache && \ @@ -15,13 +14,11 @@ RUN set -xe && \ py3-pip && \ pip install -r /tmp/requirements.txt && \ addgroup -g ${GID} -S ${GROUP} && \ - adduser -u ${UID} -S -D ${USER} ${GROUP} && \ - chmod a+x /usr/bin/entrypoint.sh && \ - mkdir /app && chown ${USER} /app - - + adduser -u ${UID} -S -D ${USER} ${GROUP} COPY --chown=${USER} k8sci/ /app/k8sci/ WORKDIR /app USER ${USER} +ENV PYTHONUNBUFFERED=TRUE -ENTRYPOINT /usr/bin/entrypoint.sh \ No newline at end of file +ENTRYPOINT echo $(echo ALPINE_VERSION: && /bin/cat /etc/alpine-release) && \ + gunicorn --bind 0.0.0.0:5000 --enable-stdio-inheritance --error-logfile "-" k8sci.wsgi:app \ No newline at end of file diff --git a/Dockerfile_distroless b/Dockerfile_distroless new file mode 100644 index 0000000..bf3a6fa --- /dev/null +++ b/Dockerfile_distroless @@ -0,0 +1,15 @@ +FROM python:3.7-slim AS build +COPY requirements.txt /tmp/requirements.txt +RUN pip install -r /tmp/requirements.txt + +### INFO: +# What is distroless: https://medium.com/better-programming/how-to-harden-your-containers-with-distroless-docker-images-c2abd7c71fdb +# Google Base Images: https://github.com/GoogleContainerTools/distroless/ +FROM gcr.io/distroless/python3-debian10 +COPY --chown=nonroot k8sci/ /app/k8sci/ +COPY --from=build --chown=nonroot /usr/local/bin/gunicorn /app/gunicorn +COPY --from=build --chown=nonroot /usr/local/lib/python3.7/site-packages /usr/local/lib/python3.7/site-packages +USER nonroot +WORKDIR /app +ENV PYTHONPATH=/usr/local/lib/python3.7/site-packages PYTHONUNBUFFERED=TRUE +CMD ["gunicorn","--bind","0.0.0.0:5000","--enable-stdio-inheritance","--error-logfile","-","k8sci.wsgi:app"] \ No newline at end of file diff --git a/entrypoint.sh b/entrypoint.sh deleted file mode 100644 index 8a4fab6..0000000 --- a/entrypoint.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/usr/bin/env sh - -set -xe - -echo $(echo ALPINE_VERSION: && /bin/cat /etc/alpine-release) - -export PYTHONUNBUFFERED=TRUE -cd /app -gunicorn --bind 0.0.0.0:5000 --enable-stdio-inheritance --error-logfile "-" k8sci.wsgi:app