Skip to content

Commit

Permalink
fix docker
Browse files Browse the repository at this point in the history
  • Loading branch information
notdodo committed Oct 27, 2024
1 parent 46e661b commit 182ebff
Showing 1 changed file with 12 additions and 8 deletions.
20 changes: 12 additions & 8 deletions auto-tagger/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM python:3-alpine AS builder
FROM python:3.12-alpine AS builder
HEALTHCHECK NONE

ENV PATH="${PATH}:/app/.local/bin" \
Expand All @@ -8,23 +8,27 @@ ENV PATH="${PATH}:/app/.local/bin" \
POETRY_VIRTUALENVS_IN_PROJECT=1 \
POETRY_VIRTUALENVS_CREATE=1

RUN apk add curl musl-dev libffi-dev gcc --no-cache
RUN apk add musl-dev libffi-dev gcc --no-cache

Check warning on line 11 in auto-tagger/Dockerfile

View workflow job for this annotation

GitHub Actions / infra-scan / Scan with Kics

[MEDIUM] Unpinned Package Version in Apk Add

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes
RUN addgroup -g 1000 app && adduser -G app -u 999 -s /sbin/nologin -h /app app -D
USER app
WORKDIR /app
COPY --chown=app:app pyproject.toml poetry.lock /app/
RUN curl -sSL https://install.python-poetry.org | python - && poetry install --only main
COPY pyproject.toml poetry.lock /app/
RUN chmod -R a+r /app
USER app
RUN pip install poetry

Check warning on line 17 in auto-tagger/Dockerfile

View workflow job for this annotation

GitHub Actions / infra-scan / Scan with Kics

[MEDIUM] Unpinned Package Version in Pip Install

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

Check warning on line 17 in auto-tagger/Dockerfile

View workflow job for this annotation

GitHub Actions / infra-scan / Scan with Kics

[LOW] Pip install Keeping Cached Packages

When installing packages with pip, the '--no-cache-dir' flag should be set to make Docker images smaller
RUN poetry install --only main

FROM python:3-alpine AS runtime
FROM python:3.12-alpine AS runtime
HEALTHCHECK NONE

ENV VIRTUAL_ENV=/app/.venv \
PATH="/app/.venv/bin:${PATH}"

RUN addgroup -g 1000 app && adduser -G app -u 999 -s /sbin/nologin -h /app app -D
USER app
WORKDIR /app
COPY --from=builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
COPY --chown=app:app *.py /app/
COPY *.py /app/
RUN chmod -R a+r /app

Check warning on line 30 in auto-tagger/Dockerfile

View workflow job for this annotation

GitHub Actions / infra-scan / Scan with Kics

[LOW] Multiple RUN, ADD, COPY, Instructions Listed

Multiple commands (RUN, COPY, ADD) should be grouped in order to reduce the number of layers.
RUN ls -la
USER app

CMD ["python", "/app/main.py"]

0 comments on commit 182ebff

Please sign in to comment.