forked from cartsnitch/cartsnitch
Test User
3216e6a1c2
- Bump cryptography>=46.0 to fix GHSA-r6ph-v2qm-q3c2 - Increment APT_CACHE_BUST to 1 to force fresh apt-get upgrade for OpenSSL/libssl3t64 (fixes CVE-2026-2673, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31790) - Add 89 Chrome CVEs to grype.yaml ignore (Playwright bundles Chromium — CVEs can only be resolved by upgrading Playwright) - Add node CVE-2026-21710 to grype.yaml ignore (Playwright bundled tooling dependency) Co-Authored-By: Paperclip <noreply@paperclip.ing>
67 lines
1.9 KiB
Docker
67 lines
1.9 KiB
Docker
# Stage 1: Build dependencies
|
|
FROM python:3.12-slim AS build
|
|
|
|
WORKDIR /app
|
|
|
|
# build-essential and libpq-dev are needed to compile any C-extension wheels
|
|
# (e.g. psycopg2 fallback). No git needed — common/ is copied from the repo root.
|
|
ARG APT_CACHE_BUST=1
|
|
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
|
|
libpq-dev \
|
|
build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Build context is the repo root. These paths are relative to the root.
|
|
COPY receiptwitness/pyproject.toml ./
|
|
COPY receiptwitness/src/ ./src/
|
|
COPY common/ ./common/
|
|
|
|
# Install from the local common/ (cartsnitch-common>=0.1.0 in pyproject.toml
|
|
# will be satisfied by the local package) then install receiptwitness itself.
|
|
RUN pip install --no-cache-dir --prefix=/install ./common/ .
|
|
|
|
# Stage 2: Production image with Playwright + Chromium
|
|
FROM python:3.12-slim AS prod
|
|
|
|
WORKDIR /app
|
|
|
|
# Install Playwright system dependencies for Chromium
|
|
ARG APT_CACHE_BUST=1
|
|
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
|
|
libnss3 \
|
|
libatk1.0-0 \
|
|
libatk-bridge2.0-0 \
|
|
libcups2 \
|
|
libdrm2 \
|
|
libxkbcommon0 \
|
|
libxcomposite1 \
|
|
libxdamage1 \
|
|
libxrandr2 \
|
|
libgbm1 \
|
|
libpango-1.0-0 \
|
|
libcairo2 \
|
|
libasound2 \
|
|
libxshmfence1 \
|
|
libx11-xcb1 \
|
|
libxcb-dri3-0 \
|
|
fonts-liberation \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN adduser --system --group --uid 1000 app
|
|
|
|
COPY --from=build /install /usr/local
|
|
COPY receiptwitness/src/ ./src/
|
|
|
|
# Install Playwright Chromium browser (runs as root; /opt/playwright is world-readable)
|
|
RUN PLAYWRIGHT_BROWSERS_PATH=/opt/playwright playwright install chromium
|
|
|
|
ENV PLAYWRIGHT_BROWSERS_PATH=/opt/playwright
|
|
|
|
USER 1000
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=3s \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"
|
|
|
|
CMD ["uvicorn", "receiptwitness.main:app", "--host", "0.0.0.0", "--port", "8000"]
|