0e213d8549
* chore: update Dockerfile to run it as non-root user across multiple apps and install shadow-utils * chore: update Dockerfiles to install shadow-utils using dnf and ensure non-root user execution in admin, web, and live apps * chore: add Dockerfile configurations for Node Runner and Flux, including shadow-utils installation and non-root user execution * chore: update Dockerfile.fips to set permissions for /app and /var/tls, and expose port 8000 * chore: update Dockerfiles to install crypto-policies and set FIPS mode across multiple applications * chore: replace microdnf with dnf for installing crypto-policies in Dockerfiles for admin and web applications * chore: update Dockerfiles to set up Nginx directories and rebuild sharp for UBI compatibility in admin, live, and web applications * chore: update Dockerfiles to include /run directory for Nginx and adjust ownership settings in admin, live, and web applications * chore: refactor Dockerfile.fips to use node:22-alpine, streamline dependency installation, and adjust working directory structure for the live application * chore: update Dockerfile.fips to use UBI base image, streamline dependency installation, and enhance runtime configuration for the live application * fix: exclude src/scripts from tsc to resolve missing @hocuspocus/provider types * feat: add FIPS Docker image variables for Node Runner and Flux * fix: update TURBO_VERSION to 2.8.13 and clean up Dockerfile --------- Co-authored-by: Palanikannan M <[email protected]>
82 lines
1.9 KiB
Docker
82 lines
1.9 KiB
Docker
FROM registry.access.redhat.com/ubi10/python-312-minimal
|
|
|
|
# -------------------------
|
|
# Base environment
|
|
# -------------------------
|
|
USER root
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
INSTANCE_CHANGELOG_URL=https://sites.plane.so/pages/f366114e9aba4cbfbe4265b8f2b74f65/
|
|
|
|
WORKDIR /code
|
|
|
|
# -------------------------
|
|
# Runtime OS dependencies
|
|
# -------------------------
|
|
RUN microdnf install -y \
|
|
postgresql-libs \
|
|
postgresql-devel \
|
|
libxslt \
|
|
xmlsec1 \
|
|
xmlsec1-openssl \
|
|
ca-certificates \
|
|
openldap-devel \
|
|
libffi-devel \
|
|
python3.12-devel \
|
|
gcc \
|
|
make \
|
|
hostname \
|
|
iproute \
|
|
procps-ng \
|
|
gawk \
|
|
openssl \
|
|
crypto-policies \
|
|
shadow-utils \
|
|
&& microdnf clean all \
|
|
&& rm -rf /var/cache/microdnf
|
|
|
|
# -------------------------
|
|
# Python deps
|
|
# -------------------------
|
|
COPY requirements.txt .
|
|
COPY requirements ./requirements
|
|
|
|
RUN pip install -r requirements.txt --compile --no-cache-dir
|
|
|
|
# -------------------------
|
|
# App files
|
|
# -------------------------
|
|
COPY manage.py manage.py
|
|
COPY pyproject.toml pyproject.toml
|
|
COPY plane plane/
|
|
COPY templates templates/
|
|
COPY package.json package.json
|
|
COPY LICENSE.txt .
|
|
|
|
RUN mkdir -p /usr/share/licenses/plane/
|
|
COPY LICENSE.txt /usr/share/licenses/plane/LICENSE.txt
|
|
COPY ./bin ./bin/
|
|
|
|
# -------------------------
|
|
# Create non-root user
|
|
# -------------------------
|
|
RUN groupadd -g 1000 plane && useradd -u 1000 -g plane -s /bin/sh -d /code plane
|
|
# Install the package to register the `plane` console script
|
|
RUN pip install --no-deps --no-cache-dir .
|
|
|
|
RUN mkdir -p /code/plane/logs && \
|
|
chmod +x ./bin/* && \
|
|
chmod -R 755 /code && \
|
|
chown -R plane:plane /code
|
|
|
|
# -------------------------
|
|
# Drop privileges
|
|
# -------------------------
|
|
USER plane
|
|
|
|
# Expose container port
|
|
EXPOSE 8000
|
|
|
|
CMD ["./bin/docker-entrypoint-api.sh"] |