File size: 1,952 Bytes
f959360 f574b59 f959360 f574b59 f959360 f574b59 f959360 f574b59 f959360 f574b59 f959360 f574b59 f959360 f574b59 f959360 f574b59 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
# Use an official Python runtime as a parent image
FROM python:3.10-slim
# Define arguments for user/group IDs (optional, but good practice)
ARG USER_ID=1001
ARG GROUP_ID=1001
# Create a non-root user and group
# Use standard IDs > 1000. Don't use 'node' or common names if not applicable.
RUN groupadd --system --gid ${GROUP_ID} appgroup && \
useradd --system --uid ${USER_ID} --gid appgroup --shell /sbin/nologin --create-home appuser
# Set the working directory
WORKDIR /app
# Create essential directories and set ownership *before* copying files
# DuckDB UI often uses ~/.duckdb (which will be /home/appuser/.duckdb)
# Ensure these are owned by the user *before* VOLUME instruction
RUN mkdir -p /app/data /home/appuser/.duckdb && \
chown -R ${USER_ID}:${GROUP_ID} /app /home/appuser/.duckdb
# Switch context to the non-root user early for subsequent RUN/COPY commands
USER appuser
# Copy requirements file (as appuser)
COPY requirements.txt .
# Install dependencies (as appuser)
# This also ensures packages are installed in a user-context if applicable
RUN pip install --no-cache-dir --user --upgrade pip && \
pip install --no-cache-dir --user -r requirements.txt
# Copy application code (as appuser)
COPY main.py .
# --- Define Volumes ---
# These paths MUST match the directories the 'appuser' process will write to.
# Note: We created and chowned these earlier.
VOLUME /app/data
VOLUME /home/appuser/.duckdb
# --- End Define Volumes ---
# Expose ports
EXPOSE 8000
EXPOSE 8080
# Define environment variables
ENV PYTHONUNBUFFERED=1
ENV UI_EXPECTED_PORT=8080
# Ensure Python user packages are in the path
ENV PATH="/home/appuser/.local/bin:${PATH}"
# Set HOME so things like ~/.duckdb resolve correctly
ENV HOME=/home/appuser
# Command to run the application (now runs as appuser)
# No chmod needed here. Ownership was handled during build.
CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"] |