f1fdf27012
- Repo scaffolding: .gitignore, .env.example, Makefile, docker-compose.yml, README.md, CHANGELOG.md, pre-commit config. - Three-service stack: api (Flask 3), db (postgres:16-alpine), front (nginx serving the Vite bundle). Named volumes metamorph_db + metamorph_evidence. - Backend skeleton: Flask app factory, JSON structured logging on stdout, GET /api/v1/health, multi-stage Dockerfile, pyproject.toml driven by uv, Pydantic Settings with secret guard rails (refuses to boot in non-dev with placeholders), APP_ENV gating. - Frontend skeleton: Vite + React 18 + TypeScript strict + TailwindCSS, RTOps design tokens from tasks/design.md, self-hosted JetBrains Mono / IBM Plex Sans via @fontsource, base UI primitives (Card/Tag/SectionHeader/FlowNode/ Button), home page wired to /api/v1/health. - Engine-agnostic Makefile: auto-detects docker or podman, picks the matching compose driver. Targets: up/down/build/rebuild/dev/lint/fmt/test/migrate/ seed-mitre/print-install-token/e2e/inspect-health. - Playwright suite: e2e/tests/m0-smoke.spec.ts (8 tests) + HTML + JUnit reports + traces on retry. - Docs: tasks/spec.md (finalized after Q&A), tasks/design.md, tasks/todo.md (14 milestones), tasks/testing-m0.md, tasks/lessons.md. DoD: make up + make health + make e2e all pass on podman 5.x (Fedora) and docker. TLS terminated by external reverse proxy (spec §6 NF-network). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
86 lines
2.7 KiB
Docker
86 lines
2.7 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
# === Stage 1: install deps with uv ===
|
|
FROM docker.io/library/python:3.12-slim AS deps
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
# Install uv (fast, reproducible Python package manager)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& curl -LsSf https://astral.sh/uv/install.sh | sh \
|
|
&& ln -s /root/.local/bin/uv /usr/local/bin/uv
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml ./
|
|
# Resolve & install deps into a dedicated venv. After running `uv lock` locally,
|
|
# switch this to `uv sync --frozen --no-dev` for fully reproducible builds.
|
|
RUN uv venv /opt/venv \
|
|
&& uv pip install --python /opt/venv/bin/python --no-cache .
|
|
|
|
# === Stage 2: runtime ===
|
|
FROM docker.io/library/python:3.12-slim AS runtime
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH="/opt/venv/bin:$PATH"
|
|
|
|
# Non-root user
|
|
RUN groupadd --gid 10001 metamorph \
|
|
&& useradd --uid 10001 --gid metamorph --shell /usr/sbin/nologin --create-home metamorph \
|
|
&& mkdir -p /data/evidence \
|
|
&& chown -R metamorph:metamorph /data
|
|
|
|
COPY --from=deps /opt/venv /opt/venv
|
|
|
|
WORKDIR /app
|
|
COPY --chown=metamorph:metamorph app ./app
|
|
COPY --chown=metamorph:metamorph alembic ./alembic
|
|
COPY --chown=metamorph:metamorph alembic.ini pyproject.toml ./
|
|
|
|
USER metamorph
|
|
|
|
EXPOSE 8000
|
|
|
|
# Healthcheck hits the local API.
|
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
|
|
CMD python -c "import urllib.request,sys; \
|
|
sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/v1/health',timeout=2).status==200 else 1)"
|
|
|
|
CMD ["gunicorn", "app.main:app", \
|
|
"--bind", "0.0.0.0:8000", \
|
|
"--workers", "2", \
|
|
"--threads", "4", \
|
|
"--access-logfile", "-", \
|
|
"--error-logfile", "-", \
|
|
"--log-level", "info"]
|
|
|
|
# === Stage 3: test image — runtime deps + dev extras + tests dir ===
|
|
# Built only when explicitly targeted (`build --target test`). Not used in prod.
|
|
FROM docker.io/library/python:3.12-slim AS test
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH="/opt/venv/bin:$PATH"
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& curl -LsSf https://astral.sh/uv/install.sh | sh \
|
|
&& ln -s /root/.local/bin/uv /usr/local/bin/uv
|
|
|
|
COPY --from=deps /opt/venv /opt/venv
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml ./
|
|
# Install the dev extras (pytest, ruff, httpx) on top of the runtime venv.
|
|
RUN uv pip install --python /opt/venv/bin/python --no-cache ".[dev]"
|
|
|
|
COPY app ./app
|
|
COPY alembic ./alembic
|
|
COPY alembic.ini ./
|
|
COPY tests ./tests
|
|
|
|
CMD ["python", "-m", "pytest", "tests", "-v"]
|