eSlider
669e8ff005
Add swarm uid 10001 in both build stages so Trivy config scan passes and containers do not run as root. Mounted /data volumes should be world-writable or owned by uid 10001 (var/t1 from Ansible is 0777).
34 lines
1.1 KiB
Docker
34 lines
1.1 KiB
Docker
FROM python:3.12-slim AS test
|
|
|
|
WORKDIR /app
|
|
COPY requirements.txt .
|
|
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt pytest
|
|
COPY virtual_drone ./virtual_drone
|
|
COPY monitoring ./monitoring
|
|
COPY explorer ./explorer
|
|
COPY tests ./tests
|
|
RUN groupadd --gid 10001 swarm \
|
|
&& useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \
|
|
&& chown -R swarm:swarm /app
|
|
USER swarm
|
|
RUN pytest tests/ -q
|
|
|
|
FROM python:3.12-slim
|
|
|
|
WORKDIR /app
|
|
COPY requirements.txt .
|
|
RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt
|
|
COPY virtual_drone ./virtual_drone
|
|
# Monitoring and explorer ship in the same image so Kubernetes can run
|
|
# them without bind mounts (Compose overrides these with live mounts)
|
|
COPY monitoring ./monitoring
|
|
COPY explorer ./explorer
|
|
RUN groupadd --gid 10001 swarm \
|
|
&& useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \
|
|
&& mkdir -p /data \
|
|
&& chown -R swarm:swarm /app /data
|
|
|
|
ENV DATA_DIR=/data
|
|
USER swarm
|
|
CMD ["python", "-m", "virtual_drone.main"]
|