Dockerfile.web

# SOURCES
# https://denisbrogg.hashnode.dev/efficient-python-docker-image-from-any-poetry-project
# https://binx.io/2022/06/13/poetry-docker/
# https://github.com/python-poetry/poetry/discussions/1879#discussioncomment-216865

# * build arg
# full semver just for python base image
ARG PYTHON_VERSION=3.11.3

FROM python:${PYTHON_VERSION}-slim-bullseye AS builder

# avoid stuck build due to user prompt
ARG DEBIAN_FRONTEND=noninteractive

# * one layer
# install dependencies
RUN apt -qq update \
    && apt -qq install \
    --no-install-recommends -y \
    curl \
    gcc \
    python3-dev \
    && rm -rf /var/lib/apt/lists/*

# * ENV layers don't add to image size
# pip env vars
ENV PIP_NO_CACHE_DIR=off
ENV PIP_DISABLE_PIP_VERSION_CHECK=on
ENV PIP_DEFAULT_TIMEOUT=100

# poetry env vars
ENV POETRY_HOME="/opt/poetry"
ENV POETRY_VERSION=1.4.2
ENV POETRY_VIRTUALENVS_IN_PROJECT=true
ENV POETRY_NO_INTERACTION=1

# * custom PATH
# path
ENV VENV="/opt/venv"
ENV PATH="$POETRY_HOME/bin:$VENV/bin:$PATH"

# * WORKDIR creates dir if it doesn't exist
WORKDIR /app
COPY . .

# * one layer that installs poetry and dependencies
# * is thrown overboard in the next stage
RUN python -m venv $VENV \
    && . "${VENV}/bin/activate" \
    && python -m pip install "poetry==${POETRY_VERSION}" \
    && poetry install --no-ansi --no-root --without dev

# * multi-stage w/build arg
FROM python:${PYTHON_VERSION}-slim-bullseye AS runner

# * standard user (lock down permissions)
# setup standard non-root user for use downstream
ENV USER_NAME=appuser
ENV USER_GROUP=appuser
ENV HOME="/home/${USER_NAME}"

RUN groupadd ${USER_NAME} \
    && useradd -m ${USER_NAME} -g ${USER_GROUP}

# * set hostname (instead of container id)
ENV HOSTNAME="${HOST:-localhost}"

# * custom PATH
ENV VENV="/opt/venv"

ENV PATH="${VENV}/bin:${VENV}/lib/python${PYTHON_VERSION}/site-packages:/usr/local/bin:${HOME}/.local/bin:/bin:/usr/bin:/usr/share/doc:$PATH"

# standardise on locale, don't generate .pyc, enable tracebacks on seg faults
ENV LANG C.UTF-8
ENV LC_ALL C.UTF-8
ENV PYTHONDONTWRITEBYTECODE 1
ENV PYTHONFAULTHANDLER 1

# workers per core
# https://github.com/tiangolo/uvicorn-gunicorn-fastapi-docker/blob/master/README.md#web_concurrency
ENV WEB_CONCURRENCY=2

# avoid stuck build due to user prompt
ARG DEBIAN_FRONTEND=noninteractive

# * one layer for startup script
# install dependencies
RUN apt -qq update \
    && apt -qq install \
    --no-install-recommends -y \
    curl \
    lsof \
    && rm -rf /var/lib/apt/lists/*

# * mkdir/cd, copy, chown for standard user
WORKDIR /app
COPY --chown=${USER_NAME} . .
COPY --from=builder --chown=${USER_NAME} "$VENV" "$VENV"

# * parameterized user
USER ${USER_NAME}

# * parameterized ports; can be overridden at runtime
# * and passed to the startup script via shell form
# listening port (not published)
EXPOSE ${PORT:-3000}
ENV OVER_PORT=${OVER_PORT:-$PORT}

# exec form (preferred; needs double quotes)
# ENTRYPOINT ["python", "main.py"]
# ENTRYPOINT ["/bin/sh", "-x", "startup.sh"]
# CMD ["5000"]

# shell form (shell expansion possible)
CMD /bin/sh -x startup.sh ${OVER_PORT:-$PORT}