Skip to content

Commit ebaccfd

Browse files
trentappleolaservo
trentapple
and
olaservo
authored
fix: Containers - Bind Mounts - Security and Compatibility (Docker / Podman / SELinux) for Fetch, Git, and Time Servers (#2205)
* Update Dockerfile for fetch Initial patch for podman and SELinux contexts. * Update Dockerfile for time podman and SELinux * Update Dockerfile * Also include app user / group (securely) such that the build succeeds * Container app user optional add (#1) * Update Dockerfile git * Update Dockerfile fetch * Update Dockerfile time * Update Dockerfile * Update Dockerfile * Update Dockerfile --------- Co-authored-by: Ola Hungerford <[email protected]>
1 parent cda92bd commit ebaccfd

3 files changed

Lines changed: 15 additions & 6 deletions

File tree

‎src/fetch/Dockerfile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,8 @@ ENV UV_COMPILE_BYTECODE=1
1111
ENV UV_LINK_MODE=copy
1212

1313
# Install the project's dependencies using the lockfile and settings
14+
COPY uv.lock pyproject.toml ./
1415
RUN --mount=type=cache,target=/root/.cache/uv \
15-
--mount=type=bind,source=uv.lock,target=uv.lock \
16-
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
1716
uv sync --locked --no-install-project --no-dev --no-editable
1817

1918
# Then, add the rest of the project source code and install it
@@ -27,6 +26,10 @@ FROM python:3.12-slim-bookworm
2726
WORKDIR /app
2827

2928
COPY --from=uv /root/.local /root/.local
29+
30+
RUN if ! id -u app >/dev/null 2>&1; then \
31+
useradd -rUM -s /usr/sbin/nologin app; \
32+
fi
3033
COPY --from=uv --chown=app:app /app/.venv /app/.venv
3134

3235
# Place executables in the environment at the front of the path

‎src/git/Dockerfile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,8 @@ ENV UV_COMPILE_BYTECODE=1
1111
ENV UV_LINK_MODE=copy
1212

1313
# Install the project's dependencies using the lockfile and settings
14+
COPY uv.lock pyproject.toml ./
1415
RUN --mount=type=cache,target=/root/.cache/uv \
15-
--mount=type=bind,source=uv.lock,target=uv.lock \
16-
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
1716
uv sync --locked --no-install-project --no-dev --no-editable
1817

1918
# Then, add the rest of the project source code and install it
@@ -30,6 +29,10 @@ RUN apt-get update && apt-get install -y git git-lfs && rm -rf /var/lib/apt/list
3029
WORKDIR /app
3130

3231
COPY --from=uv /root/.local /root/.local
32+
33+
RUN if ! id -u app >/dev/null 2>&1; then \
34+
useradd -rUM -s /usr/sbin/nologin app; \
35+
fi
3336
COPY --from=uv --chown=app:app /app/.venv /app/.venv
3437

3538
# Place executables in the environment at the front of the path

‎src/time/Dockerfile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,8 @@ ENV UV_COMPILE_BYTECODE=1
1111
ENV UV_LINK_MODE=copy
1212

1313
# Install the project's dependencies using the lockfile and settings
14+
COPY uv.lock pyproject.toml ./
1415
RUN --mount=type=cache,target=/root/.cache/uv \
15-
--mount=type=bind,source=uv.lock,target=uv.lock \
16-
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
1716
uv sync --locked --no-install-project --no-dev --no-editable
1817

1918
# Then, add the rest of the project source code and install it
@@ -27,6 +26,10 @@ FROM python:3.12-slim-bookworm
2726
WORKDIR /app
2827

2928
COPY --from=uv /root/.local /root/.local
29+
30+
RUN if ! id -u app >/dev/null 2>&1; then \
31+
useradd -rUM -s /usr/sbin/nologin app; \
32+
fi
3033
COPY --from=uv --chown=app:app /app/.venv /app/.venv
3134

3235
# Place executables in the environment at the front of the path

0 commit comments

Comments
 (0)