Utilize uv in Docker and workflows (#73)

Author: No767

docker/Dockerfile

@@ -1,33 +1,62 @@
-FROM python:3.13-slim-trixie
+FROM ghcr.io/astral-sh/uv:python3.13-trixie-slim AS build
+
+# Compile bytecode and enable caching
+# Ref: https://docs.astral.sh/uv/guides/integration/docker/#compiling-bytecode
+# Ref: https://docs.astral.sh/uv/guides/integration/docker/#caching
+ENV UV_COMPILE_BYTECODE=1 
+ENV UV_LINK_MODE=copy
+
+# Disable Python downloads as the system Python interpreter instead
+ENV UV_PYTHON_DOWNLOADS=0
 
-ENV DEBIAN_FRONTEND=noninteractive
+# Set Tini version
+# Ref: https://github.com/krallin/tini?tab=readme-ov-file#using-tini
 ENV TINI_VERSION=v0.19.0
 
 ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
-RUN chmod +x /tini
 
-WORKDIR /kanae
-COPY /server /kanae/server/
-COPY /requirements.txt /kanae/requirements.txt
+WORKDIR /kanae/
 
-RUN adduser --disabled-password --gecos "" kanae \
-  && chown -R kanae:kanae /kanae
+COPY requirements.txt /kanae
 
-USER kanae
+# Install dependencies
+RUN --mount=type=cache,target=/root/.cache/uv \
+    --mount=type=bind,source=requirements.txt,target=requirements.txt \
+    uv venv && uv pip install -r requirements.txt
+
+# Add project source code
+COPY server /kanae
+
+FROM python:3.13-slim-trixie
+
+ENV PYTHONUNBUFFERED=1
+ENV PYTHONPATH=/kanae
+
+# Set up non-root user
+RUN groupadd --system --gid 999 kanae \
+ && useradd --system --gid 999 --uid 999 --no-create-home kanae
 
-ENV PATH="${PATH}:/home/kanae/.local/bin"
+# Copy the server from the builder
+COPY --from=build --chmod=755 /kanae /kanae
+COPY --from=build --chmod=+x /tini /tini
 
-RUN pip install --user -r requirements.txt
+WORKDIR /kanae/
+
+# Place executables in the environment at the front of the path
+ENV PATH="/kanae/.venv/bin:$PATH"
+
+# Use non-root user
+USER kanae
 
 EXPOSE 8000
 
 ENTRYPOINT ["/tini", "--"]
 
-CMD ["python3", "/kanae/server/launcher.py"]
+CMD ["python3", "/kanae/launcher.py"]
 
 STOPSIGNAL SIGTERM
 
 LABEL org.opencontainers.image.title="Kanae"
 LABEL org.opencontainers.image.description="Internal backend server for ACM @ UC Merced"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL org.opencontainers.image.source="https://github.com/UCMercedACM/kanae"
+LABEL org.opencontainers.image.source="https://github.com/UCMercedACM/kanae"

docker/docker-compose.dev.yml

@@ -4,17 +4,13 @@ name: kanae_dev
 services:
   database:
     container_name: kanae_postgres
-    build:
-      context: ../
-      dockerfile: docker/pg-test/Dockerfile
+    image: postgres:17
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_USER: ${DB_USERNAME}
     volumes:
       - database:/var/lib/postgresql/data
-    env_file:
-      - .env
     ports:
       - 5432:5432
 

docker/docker-compose.prod.yml

@@ -6,32 +6,36 @@ services:
     image: ghcr.io/ucmercedacm/kanae:latest
     volumes:
       # Do not edit the next line. If you want to change the path of the configuration file, please edit the CONFIG_LOCATION variable
-      - ${CONFIG_LOCATION}:/kanae/server/config.yml
+      - ${CONFIG_LOCATION}:/kanae/config.yml
     ports:
       - 8000:8000
+    networks:
+      - default
+      - db_bridge
     depends_on:
       database:
         condition: service_healthy
         restart: true
       valkey:
         condition: service_healthy
         restart: true
-    env_file:
-      - .env
+      migrate:
+        condition: service_completed_successfully
     restart: always
 
   database:
     container_name: kanae_postgres
-    build:
-      context: ../
-      dockerfile: docker/pg-test/Dockerfile
+    image: postgres:17
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_USER: ${DB_USERNAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
     ports:
       - 5432:5432
+    networks:
+      - default
+      - db_bridge
     volumes:
       - database:/var/lib/postgresql/data
     healthcheck:
@@ -48,8 +52,27 @@ services:
       test: valkey-cli PING || exit 1
     ports:
       - 6379:6379
+    restart: always
+
+  migrate:
+    container_name: kanae_migrate
+    image: arigaio/atlas:latest
+    command: >
+      schema apply
+      --auto-approve
+      --to "file://schema.sql"
+      --url "postgres://${DB_USERNAME}:${DB_PASSWORD}@database:5432/${DB_DATABASE_NAME}?search_path=public&sslmode=disable"
+      --dev-url "postgres://${DB_USERNAME}:${DB_PASSWORD}@database:5432/postgres?search_path=public&sslmode=disable"
+    networks:
+      - db_bridge
+      - default
+    depends_on:
+      database:
+        condition: service_healthy
+    volumes:
+      - ../server/schema.sql:/schema.sql 
 
-  kanae-prometheus:
+  prometheus:
     container_name: kanae_prometheus
     ports:
       - 9090:9090
@@ -59,8 +82,8 @@ services:
       - prometheus-data:/prometheus
 
   # first login uses admin/admin
-  # add data source for http://kanae-prometheus:9090 to get started
-  kanae-grafana:
+  # add data source for http://prometheus:9090 to get started
+  grafana:
     container_name: kanae_grafana
     command: ['./run.sh', '-disable-reporting']
     ports:
@@ -73,3 +96,8 @@ volumes:
   database:
   prometheus-data:
   grafana-data:
+
+networks:
+  db_bridge:
+    driver: bridge
+

docker/docker-compose.yml

@@ -3,35 +3,42 @@ name: kanae
 services:
   kanae:
     container_name: kanae
-    image: ghcr.io/ucmercedacm/kanae:latest
+    # image: ghcr.io/ucmercedacm/kanae:latest
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
     volumes:
       # Do not edit the next line. If you want to change the path of the configuration file, please edit the CONFIG_LOCATION variable
-      - ${CONFIG_LOCATION}:/kanae/server/config.yml
+      - ${CONFIG_LOCATION}:/kanae/config.yml
     ports:
       - 8000:8000
+    networks:
+      - default
+      - db_bridge
     depends_on:
       database:
         condition: service_healthy
         restart: true
       valkey:
         condition: service_healthy
         restart: true
-    env_file:
-      - .env
+      migrate:
+        condition: service_completed_successfully
     restart: always
 
   database:
     container_name: kanae_postgres
-    build:
-      context: ../
-      dockerfile: docker/pg-test/Dockerfile
+    image: postgres:17
     environment:
       POSTGRES_PASSWORD: ${DB_PASSWORD}
       POSTGRES_DB: ${DB_DATABASE_NAME}
       POSTGRES_USER: ${DB_USERNAME}
       POSTGRES_INITDB_ARGS: '--data-checksums'
     ports:
       - 5432:5432
+    networks:
+      - default
+      - db_bridge
     volumes:
       - database:/var/lib/postgresql/data
     healthcheck:
@@ -48,6 +55,29 @@ services:
       test: valkey-cli PING || exit 1
     ports:
       - 6379:6379
+    restart: always
 
+  migrate:
+    container_name: kanae_migrate
+    image: arigaio/atlas:latest
+    command: >
+      schema apply
+      --auto-approve
+      --to "file://schema.sql"
+      --url "postgres://${DB_USERNAME}:${DB_PASSWORD}@database:5432/${DB_DATABASE_NAME}?search_path=public&sslmode=disable"
+      --dev-url "postgres://${DB_USERNAME}:${DB_PASSWORD}@database:5432/postgres?search_path=public&sslmode=disable"
+    networks:
+      - db_bridge
+      - default
+    depends_on:
+      database:
+        condition: service_healthy
+    volumes:
+      - ../server/schema.sql:/schema.sql
+      
 volumes:
   database:
+
+networks:
+  db_bridge:
+    driver: bridge

docker/pg-test/Dockerfile

@@ -191,17 +191,17 @@ def configure_logging(self) -> None:
         handler.setFormatter(self._determine_formatter(handler))
 
         if self.access_log:
-            file_handler = RotatingFileHandler(
-                filename="kanae-access.log",
-                encoding="utf-8",
-                mode="w",
-                maxBytes=max_bytes,
-                backupCount=5,
-            )
             access_logger.setLevel(level)
             access_logger.addHandler(handler)
 
             if not self._is_docker():
+                file_handler = RotatingFileHandler(
+                    filename="kanae-access.log",
+                    encoding="utf-8",
+                    mode="w",
+                    maxBytes=max_bytes,
+                    backupCount=5,
+                )
                 access_logger.addHandler(file_handler)
 
         root.setLevel(level)