Agent Zero
38b73f5d4d
(1) requirements.lock: 323 Pakete exakt gepinnt auf das heute getestete Set (fastapi==0.141.1, starlette==1.3.1, sqlalchemy==2.0.35, alembic==1.19.1, asyncpg==0.31.0, pydantic==2.13.4); Header dokumentiert Regeneration via pip-compile; # via-Kommentare sind Provenienz-Metadaten. (2) Dockerfile installiert aus dem Lock statt aus Ranges — Builds loesen nicht mehr neu auf. (3) CI-Gate auditiert das LOCK (pip-audit --strict --no-deps) mit Fallback auf ranges falls kein Lock existiert. (4) deploy-guide.md: Dependencies-aendern-Workflow dokumentiert. Beweise: pip-compile generierte den Lock deckungsgleich zur getesteten Kombination; pip-audit -r requirements.lock = No known vulnerabilities; bash -n Syntax OK.
92 lines
2.3 KiB
Docker
92 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# =============================================================================
|
|
# LeoCRM v1.0 - Production Dockerfile
|
|
# Multi-stage build: frontend (Node) + builder (Python) + runtime (slim)
|
|
# =============================================================================
|
|
|
|
# === Stage 0: Frontend Build ===
|
|
FROM node:20-slim AS frontend
|
|
|
|
WORKDIR /frontend
|
|
|
|
# Copy package files first for layer caching
|
|
COPY frontend/package.json frontend/package-lock.json ./
|
|
RUN npm ci --legacy-peer-deps
|
|
|
|
# Copy frontend source and build
|
|
COPY frontend/ ./
|
|
RUN npx vite build
|
|
|
|
# === Stage 1: Python Builder ===
|
|
FROM python:3.12-slim AS builder
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
libpq-dev \
|
|
libpango-1.0-0 \
|
|
libpangoft2-1.0-0 \
|
|
libcairo2 \
|
|
libgdk-pixbuf-2.0-0 \
|
|
libffi-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
COPY requirements.txt requirements.lock ./
|
|
RUN pip install --user --no-cache-dir -r requirements.lock
|
|
|
|
# === Stage 2: Runtime ===
|
|
FROM python:3.12-slim AS runtime
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PATH=/home/appuser/.local/bin:$PATH
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
libpq5 \
|
|
curl \
|
|
libpango-1.0-0 \
|
|
libpangoft2-1.0-0 \
|
|
libcairo2 \
|
|
libgdk-pixbuf-2.0-0 \
|
|
libffi8 \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -g 1000 appuser \
|
|
&& useradd -m -u 1000 -g appuser appuser
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy installed Python packages from builder
|
|
COPY --from=builder /root/.local /home/appuser/.local
|
|
|
|
# Copy application source
|
|
COPY --chown=appuser:appuser . .
|
|
|
|
# Copy built frontend from frontend stage
|
|
COPY --from=frontend --chown=appuser:appuser /frontend/dist /app/frontend/dist
|
|
|
|
# Make entrypoint scripts executable
|
|
RUN chmod +x /app/prestart.sh /app/worker.sh /app/healthcheck.sh
|
|
|
|
# Create storage directory
|
|
RUN mkdir -p /data/storage && chown -R appuser:appuser /data
|
|
|
|
USER appuser
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
|
|
CMD /app/healthcheck.sh
|
|
|
|
ENTRYPOINT ["/app/prestart.sh"]
|