westfarn
0d98eebf0b
Outbound TLS in this image still trusted the compromised eMudhra roots (`emSign ECC Root CA - G3` and `Comodo AAA Services`). - Image install now upgrades `ca-certificates` and regenerates the trust bundle. - `certifi` is locked at 2026.10.23, which drops those roots for `requests` and `httpx`. Merge this, then redeploy beta and prod. Reviewed-on: #19
31 lines
709 B
Docker
31 lines
709 B
Docker
FROM python:3.12-slim
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_PROJECT_ENVIRONMENT=/app/.venv
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates libpq5 \
|
|
&& update-ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
|
|
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN uv sync --frozen --no-dev
|
|
|
|
COPY site ./site
|
|
COPY scripts/docker-entrypoint.sh /entrypoint.sh
|
|
COPY scripts/worker-entrypoint.sh /worker-entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh /worker-entrypoint.sh
|
|
|
|
WORKDIR /app/site
|
|
|
|
EXPOSE 8000
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|