30 lines
625 B
Text
30 lines
625 B
Text
|
# Use an official Python runtime as a parent image
|
||
|
|
FROM python:3.9-slim-bookworm
|
||
|
|
|
||
|
|
# --- Basic runtime hygiene ---
|
||
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
||
|
|
PYTHONUNBUFFERED=1
|
||
|
|
|
||
|
|
# Workdir
|
||
|
|
WORKDIR /usr/src/app
|
||
|
|
|
||
|
|
# Copy only requirements first to leverage Docker layer cache
|
||
|
|
COPY requirements.txt .
|
||
|
|
|
||
|
|
# Install Python deps
|
||
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
||
|
|
|
||
|
|
# Copy the rest of your app
|
||
|
|
COPY . .
|
||
|
|
|
||
|
|
# Create a non-root user and give ownership
|
||
|
|
RUN adduser --disabled-password --gecos "" appuser \
|
||
|
|
&& chown -R appuser:appuser /usr/src/app
|
||
|
|
|
||
|
|
USER appuser
|
||
|
|
|
||
|
|
# Expose the service port
|
||
|
|
EXPOSE 5000
|
||
|
|
|
||
|
|
CMD ["python", "-u", "db.py"]
|