1+ # ------------------------------- Builder Satge -------------------------------
2+
3+ # Build stage (with dev tools for linting, testing, etc.)
4+ FROM python:3.13-slim-bookworm AS builder
5+
6+ # The installer requires curl (and certificates) to download the release archive
7+ RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && \
8+ apt-get clean && rm -rf /var/lib/apt/lists/*
9+
10+ # Download the latest installer, install it, and remove it
11+ ADD https://astral.sh/uv/install.sh /uv-installer.sh
12+ RUN chmod -R 655 /uv-installer.sh && /uv-installer.sh && rm /uv-installer.sh
13+
14+ # Set up uv environment PATH
15+ ENV PATH="/root/.local/bin/:$PATH"
16+
17+ WORKDIR /app
18+
19+ # Prevent Python from writing pyc files and buffering output
20+ ENV PYTHONDONTWRITEBYTECODE=1 \
21+ PYTHONUNBUFFERED=1
22+
23+ # Copy dependency files first for caching
24+ COPY pyproject.toml /app/
25+
26+ # Sync dependencies (includes streamlit, ruff, pytest if in pyproject.toml)
27+ RUN uv sync
28+
29+ # Copy the rest of the project
30+ COPY . /app
31+
32+ # ------------------------- Production Stage -------------------------
33+
34+ # Final stage (production, lean image)
35+ FROM python:3.13-slim-bookworm AS production
36+ WORKDIR /app
37+
38+ # Prevent Python from writing pyc files and buffering output
39+ ENV PYTHONDONTWRITEBYTECODE=1 \
40+ PYTHONUNBUFFERED=1
41+
42+ # Create a non-privileged user
43+ ARG UID=10001
44+ RUN adduser \
45+ --disabled-password \
46+ --gecos "" \
47+ --home "/nonexistent" \
48+ --shell "/sbin/nologin" \
49+ --no-create-home \
50+ --uid "${UID}" \
51+ appuser
52+
53+ # Copy the virtual env and project files
54+ COPY --from=builder /app/.venv /app/.venv
55+ COPY . /app
56+
57+ # Set PATH to use the virtual env
58+ ENV PATH="/app/.venv/bin:$PATH"
59+
60+ # Switch to non-privileged user
61+ USER appuser
62+
63+ # Expose Streamlit's default port
64+ EXPOSE 8501
65+
66+ # Run Streamlit app
67+ CMD ["streamlit" , "run" , "src/app.py" ]
0 commit comments