ansible/flaskpaste
1
0
Fork 0
forked from claw/flaskpaste
Code Pull Requests Activity

containerfile: consolidate to single alpine image

Browse Source
This commit is contained in:
Username
2026-01-21 12:17:47 +01:00
parent 79a4d1d0ea
commit 60652e96b4
4 changed files with 27 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
Containerfile
View File

@@ -1,15 +1,14 @@
# FlaskPaste Container Image (Multi-Stage Build)
# FlaskPaste Container Image (Alpine)
# Build: podman build -t flaskpaste .
# Run: podman run -d -p 5000:5000 -v flaskpaste-data:/app/data flaskpaste
# Stage 1: Build dependencies
FROM python:3.11-slim AS builder
FROM python:3.11-alpine AS builder
WORKDIR /build
# Install build dependencies
RUN apt update && apt install -y --no-install-recommends gcc \
&& apt clean && rm -rf /var/lib/apt/lists/*
# Install build dependencies for compiled Python packages
RUN apk add --no-cache gcc musl-dev libffi-dev
# Create virtual environment and upgrade pip
RUN python -m venv /opt/venv
@@ -23,19 +22,19 @@ RUN pip install --no-cache-dir -r requirements.txt gunicorn \
&& rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco*
# Stage 2: Runtime image
FROM python:3.11-slim
# Stage 2: Alpine runtime (minimal)
FROM python:3.11-alpine
LABEL maintainer="FlaskPaste"
LABEL description="Lightweight secure pastebin REST API"
LABEL description="Minimal secure pastebin REST API"
# Cleanup base image, fix base image vulnerabilities, create non-root user
# Note: System packages upgraded for Trivy scan; app runs from venv
RUN apt clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
&& pip install --no-cache-dir --upgrade pip 'setuptools>=80.0' 'jaraco.context>=6.1.0' \
# Apply security fixes to base image, remove vendored vulnerable packages
RUN pip install --no-cache-dir --upgrade pip 'setuptools>=80.0' 'jaraco.context>=6.1.0' \
&& pip cache purge 2>/dev/null || true \
&& rm -rf /root/.cache /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco* \
&& groupadd -r flaskpaste && useradd -r -g flaskpaste flaskpaste
&& rm -rf /root/.cache /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco*
# Create non-root user
RUN addgroup -g 65532 -S flaskpaste && adduser -u 65532 -S -G flaskpaste flaskpaste
# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv
@@ -44,16 +43,16 @@ ENV PATH="/opt/venv/bin:$PATH"
WORKDIR /app
# Copy application files
COPY app/ ./app/
COPY wsgi.py .
COPY fpaste .
COPY --chown=65532:65532 app/ ./app/
COPY --chown=65532:65532 wsgi.py .
COPY --chown=65532:65532 fpaste .
# Create data directory with correct ownership
# Create data directory
RUN mkdir -p /app/data && chown -R flaskpaste:flaskpaste /app
USER flaskpaste
# Environment defaults
# Environment configuration
ENV FLASK_ENV=production
ENV FLASKPASTE_DB=/app/data/pastes.db
ENV PYTHONUNBUFFERED=1