security: Harden Docker image to reduce CVE vulnerabilities (#28)

Major security improvements:
- Upgrade base image from python:3.11-slim to python:3.13-slim-bookworm (latest)
- Use multi-stage build to reduce attack surface
- Run application as non-root user (appuser)
- Apply security updates with apt-get upgrade
- Add .dockerignore to exclude sensitive files
- Add health check endpoint
- Improve logging configuration

This addresses the 30 Docker image CVEs by:
1. Using latest Python 3.13 with security patches
2. Using Debian Bookworm (latest stable) base
3. Applying all available security updates
4. Following Docker security best practices

Author: CervezaStallone

.dockerignore

@@ -0,0 +1,73 @@
+# Git
+.git
+.gitignore
+.gitattributes
+
+# Python
+__pycache__
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info
+dist
+build
+.venv
+venv
+env
+
+# Testing
+.pytest_cache
+.coverage
+htmlcov
+coverage.xml
+*.cover
+.hypothesis
+test_db.sqlite3
+
+# Development
+.vscode
+.idea
+*.swp
+*.swo
+*~
+
+# Documentation
+docs/
+*.md
+!README.md
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+
+# Docker
+Dockerfile*
+docker-compose*.yml
+.dockerignore
+
+# Logs
+logs/
+*.log
+
+# Database
+*.sqlite3
+*.sqlite3-shm
+*.sqlite3-wal
+db.sqlite3
+test_db.sqlite3
+
+# Celery
+celerybeat-schedule*
+
+# Static files (will be collected in container)
+staticfiles/
+
+# Environment
+.env
+.env.*
+!.env.example
+
+# OS
+.DS_Store
+Thumbs.db

Dockerfile

@@ -1,38 +1,78 @@
-FROM python:3.11-slim
+# Multi-stage build for smaller and more secure final image
+FROM python:3.13-slim-bookworm AS builder
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    g++ \
+    && rm -rf /var/lib/apt/lists/*
+
 # Set work directory
 WORKDIR /app
 
-# Install system dependencies
-RUN apt-get update && apt-get install -y \
-    gcc \
+# Install Python dependencies
+COPY requirements.txt /app/
+RUN pip install --upgrade pip && \
+    pip wheel --no-cache-dir --no-deps --wheel-dir /app/wheels -r requirements.txt
+
+# Final stage
+FROM python:3.13-slim-bookworm
+
+# Create non-root user for security
+RUN groupadd -r appuser && useradd -r -g appuser appuser
+
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV PATH="/home/appuser/.local/bin:$PATH"
+
+# Install runtime dependencies and security updates
+RUN apt-get update && apt-get install -y --no-install-recommends \
     postgresql-client \
+    && apt-get upgrade -y \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Python dependencies
-COPY requirements.txt /app/
+# Set work directory
+WORKDIR /app
+
+# Copy wheels from builder
+COPY --from=builder /app/wheels /wheels
+COPY --from=builder /app/requirements.txt .
+
+# Install Python dependencies from wheels
 RUN pip install --upgrade pip && \
-    pip install --no-cache-dir -r requirements.txt
+    pip install --no-cache /wheels/* && \
+    rm -rf /wheels
 
 # Copy project
-COPY . /app/
+COPY --chown=appuser:appuser . /app/
 
-# Create necessary directories
-RUN mkdir -p /app/logs /app/staticfiles /app/media
+# Create necessary directories with proper permissions
+RUN mkdir -p /app/logs /app/staticfiles /app/media && \
+    chown -R appuser:appuser /app
+
+# Switch to non-root user
+USER appuser
 
 # Collect static files
 RUN python manage.py collectstatic --noinput || true
 
 # Expose port
 EXPOSE 8000
 
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health/').read()" || exit 1
+
 # Run Gunicorn with Uvicorn workers for ASGI support
 CMD ["gunicorn", "modbus_webserver.asgi:application", \
      "-k", "uvicorn.workers.UvicornWorker", \
      "--bind", "0.0.0.0:8000", \
      "--workers", "4", \
-     "--timeout", "120"]
+     "--timeout", "120", \
+     "--access-logfile", "-", \
+     "--error-logfile", "-"]