Dockerfile

# stage: baseline
ARG DOCKER_BASE_IMAGE
ARG TRIVY_DOCKER_IMAGE="aquasec/trivy:0.48.1"

FROM $TRIVY_DOCKER_IMAGE as trivy

FROM $DOCKER_BASE_IMAGE AS base

ARG PYSETUP_PATH
ENV PIP_DEFAULT_TIMEOUT=100 \
  PIP_DISABLE_PIP_VERSION_CHECK=1 \
  PIP_NO_CACHE_DIR=1 \
  POETRY_NO_INTERACTION=1 \
  POETRY_VIRTUALENVS_IN_PROJECT=true \
  PYTHONFAULTHANDLER=1 \
  PYTHONHASHSEED=random \
  PYTHONUNBUFFERED=1 \
  LOCAL_USER=alice \
  POETRY_VERSION=1.7.1
ENV VENV_PATH="$PYSETUP_PATH/.venv"
ENV PATH="$VENV_PATH/bin:$PATH"

# create non root user
RUN mkdir $PYSETUP_PATH && \
    groupadd --system $LOCAL_USER && \
    useradd --no-log-init --create-home --system --shell /bin/bash -g $LOCAL_USER $LOCAL_USER && \
    chown $LOCAL_USER:$LOCAL_USER $PYSETUP_PATH

# update the base image to latest security fixes and tools
RUN apt-get update && apt-get -y upgrade && rm -rf /var/lib/apt/lists/* && \
    /usr/local/bin/python3 -m pip install --upgrade setuptools pip

WORKDIR $PYSETUP_PATH
USER $LOCAL_USER
ENTRYPOINT []
CMD []

# stage: builder (creates the .venv from poetry)
FROM base AS builder
USER root
RUN pip install -U pip "poetry==$POETRY_VERSION"
USER $LOCAL_USER

COPY --chown=$LOCAL_USER:$LOCAL_USER pyproject.toml poetry.lock poetry.toml ./
RUN poetry install --no-root --only main

COPY --chown=$LOCAL_USER:$LOCAL_USER src/ src/
COPY --chown=$LOCAL_USER:$LOCAL_USER main.py .
COPY --chown=$LOCAL_USER:$LOCAL_USER LICENSE .
RUN poetry install --only-root

# stage: production image
FROM base AS production
COPY --from=builder $PYSETUP_PATH $PYSETUP_PATH
ENTRYPOINT ["python", "-I", "-OO", "main.py"]

# stage: vulnerability scanner on prod image
FROM production AS vulnscan
COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy
ENTRYPOINT ["trivy"]

# stage: testing
FROM base AS testing
COPY --from=builder $PYSETUP_PATH $PYSETUP_PATH

USER root
RUN apt-get update && apt-get -y install --no-install-recommends make && rm -rf /var/lib/apt/lists/*
RUN pip install -U pip "poetry==$POETRY_VERSION"
RUN poetry install && \
    chown -R $LOCAL_USER:$LOCAL_USER $PYSETUP_PATH
USER $LOCAL_USER

COPY --chown=$LOCAL_USER:$LOCAL_USER docs/ docs/
COPY --chown=$LOCAL_USER:$LOCAL_USER tests/ tests/
COPY --chown=$LOCAL_USER:$LOCAL_USER Makefile .

# stage: migrations
FROM base as migrations
COPY --from=builder $PYSETUP_PATH $PYSETUP_PATH

USER root
RUN apt-get update && apt-get install -y --no-install-recommends postgresql-client && rm -rf /var/lib/apt/lists/*
USER $LOCAL_USER

# COPY --chown=$LOCAL_USER:$LOCAL_USER migrations/ migrations/
# COPY --chown=$LOCAL_USER:$LOCAL_USER alembic.ini .

# ENTRYPOINT ["./migrations/run_migrations.sh"]