ansible/flaskpaste
1
0
Fork 0
forked from claw/flaskpaste
Code Pull Requests Activity

containerfile: remove vendored jaraco from setuptools, purge pip cache

Browse Source
This commit is contained in:
Username
2026-01-20 08:28:26 +01:00
parent 5a05af4764
commit f5f2f8f363
2 changed files with 13 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
Containerfile
View File

@@ -16,10 +16,11 @@ RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
RUN pip install --no-cache-dir --upgrade pip wheel
# Install Python dependencies (includes security pins for setuptools, jaraco.context)
# Install Python dependencies (includes security pins from requirements.txt)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt gunicorn \
&& rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco.context*.dist-info
&& pip cache purge 2>/dev/null || true \
&& rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco*
# Stage 2: Runtime image
@@ -32,7 +33,8 @@ LABEL description="Lightweight secure pastebin REST API"
# Note: System packages upgraded for Trivy scan; app runs from venv
RUN apt clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
&& pip install --no-cache-dir --upgrade pip 'setuptools>=80.0' 'jaraco.context>=6.1.0' \
&& rm -rf /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco.context*.dist-info \
&& pip cache purge 2>/dev/null || true \
&& rm -rf /root/.cache /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco* \
&& groupadd -r flaskpaste && useradd -r -g flaskpaste flaskpaste
# Copy virtual environment from builder

17
Containerfile.slim
View File

@@ -16,12 +16,13 @@ RUN apk add --no-cache gcc musl-dev libffi-dev
# Create virtual environment and upgrade pip
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
RUN pip install --no-cache-dir --upgrade "pip>=25.3" wheel
RUN pip install --no-cache-dir --upgrade pip wheel
# Install Python dependencies (includes security pins from requirements.txt)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt gunicorn && \
pip install --no-cache-dir --force-reinstall --no-deps "jaraco.context>=6.1.0"
RUN pip install --no-cache-dir -r requirements.txt gunicorn \
&& pip cache purge 2>/dev/null || true \
&& rm -rf /opt/venv/lib/python*/site-packages/setuptools/_vendor/jaraco*
# Stage 2: Alpine runtime (minimal)
@@ -30,12 +31,10 @@ FROM python:3.11-alpine
LABEL maintainer="FlaskPaste"
LABEL description="Minimal secure pastebin REST API (Alpine)"
# Apply security fixes to base image (versions from requirements.txt)
COPY requirements.txt /tmp/
RUN pip install --no-cache-dir --upgrade pip && \
pip install --no-cache-dir -r /tmp/requirements.txt && \
pip install --no-cache-dir --force-reinstall --no-deps "jaraco.context>=6.1.0" && \
rm /tmp/requirements.txt
# Apply security fixes to base image, remove vendored vulnerable packages
RUN pip install --no-cache-dir --upgrade pip 'setuptools>=80.0' 'jaraco.context>=6.1.0' \
&& pip cache purge 2>/dev/null || true \
&& rm -rf /root/.cache /usr/local/lib/python*/site-packages/setuptools/_vendor/jaraco*
# Create non-root user
RUN addgroup -g 65532 -S flaskpaste && adduser -u 65532 -S -G flaskpaste flaskpaste