fix: fixed dockerfile for security and made google cloud compliant

Author: RndmCodeGuy20

Dockerfile

@@ -3,42 +3,42 @@ FROM python:3.12-slim
 WORKDIR /app
 
 # Set environment variables
-ENV APP_NAME=rag_chat_api
-ENV PYTHONDONTWRITEBYTECODE=1
-ENV PYTHONUNBUFFERED=1
+ENV APP_NAME=rag_chat_api \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    #    GOOGLE_API_KEY and GITHUB_TOKEN should be passed securely at runtime
+    CHROMA_PATH=/app/db/chroma \
+    DATA_STORE_PATH=/app/db/knowledge_base 
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     libmagic1 \
-    && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
 # Create necessary directories with proper permissions
-RUN mkdir -p db/chroma && \
-    chmod -R 755 db
+RUN mkdir -p /app/db/chroma && \
+    chmod -R 755 /app/db
 
-# IMPORTANT: Copy and install requirements first
+# Copy and install requirements first to leverage caching
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 # Copy pre-built ChromaDB (if it exists locally)
 COPY db/chroma /app/db/chroma
-
-# Set proper permissions for the ChromaDB
 RUN chmod -R 755 /app/db/chroma
 
 # Copy configuration files
-COPY .env.prod ./.env.prod
-COPY docker-entrypoint.sh ./
-RUN chmod +x ./docker-entrypoint.sh
+COPY .env.prod /app/.env.prod
+COPY docker-entrypoint.sh /app/
+RUN chmod +x /app/docker-entrypoint.sh
 
 # Copy source code
-COPY embeddings.py api.py ./
+COPY embeddings.py api.py /app/
 
 # Expose the API port
 EXPOSE 8000
 
 # Command to run the application
-ENTRYPOINT ["./docker-entrypoint.sh"]
+ENTRYPOINT ["/app/docker-entrypoint.sh"]
 CMD ["uvicorn", "api:app", "--host", "0.0.0.0", "--port", "8000"]

Dockerfile.bak

@@ -0,0 +1,44 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+# Set environment variables
+ENV APP_NAME=rag_chat_api
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libmagic1 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create necessary directories with proper permissions
+RUN mkdir -p db/chroma && \
+    chmod -R 755 db
+
+# IMPORTANT: Copy and install requirements first
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy pre-built ChromaDB (if it exists locally)
+COPY db/chroma /app/db/chroma
+
+# Set proper permissions for the ChromaDB
+RUN chmod -R 755 /app/db/chroma
+
+# Copy configuration files
+COPY .env.prod ./.env.prod
+COPY docker-entrypoint.sh ./
+RUN chmod +x ./docker-entrypoint.sh
+
+# Copy source code
+COPY embeddings.py api.py ./
+
+# Expose the API port
+EXPOSE 8000
+
+# Command to run the application
+ENTRYPOINT ["./docker-entrypoint.sh"]
+CMD ["uvicorn", "api:app", "--host", "0.0.0.0", "--port", "8000"]

deploy.sh

@@ -5,7 +5,16 @@ set -e
 ./prepare-db.sh
 
 # Build and start the Docker containers
-docker-compose up -d
+# docker-compose up -d
+
+docker buildx build \
+  --platform linux/amd64 \
+  -t rndmcodeguy/rag-chat-api:v1.0.2 \
+  --build-arg GOOGLE_API_KEY=$GOOGLE_API_KEY \
+  --build-arg GITHUB_TOKEN=$GITHUB_TOKEN \
+  --build-arg CHROMA_PATH=$CHROMA_PATH \
+  --build-arg DATA_STORE_PATH=$DATA_STORE_PATH \
+  --push . \
 
 echo "API is running at http://localhost:8000"
 echo "To test it, try: curl -X POST http://localhost:8000/query -H 'Content-Type: application/json' -d '{\"query\":\"How to install rcg?\"}'"

docker-compose.yaml

@@ -2,6 +2,7 @@ services:
   api:
     build: .
     container_name: api
+    image: rndmcodeguy/rag-chat-api:v1.0.1
     ports:
       - "8000:8000"
     volumes:
@@ -11,6 +12,7 @@ services:
       - CHROMA_PATH=/app/db/chroma
       - DATA_STORE_PATH=/app/db/knowledge_base
       - GOOGLE_API_KEY=${GOOGLE_API_KEY}
+      - GITHUB_TOKEN=${GITHUB_TOKEN}
     restart: unless-stopped
 
 volumes:

prepare-db.sh

@@ -1,9 +1,6 @@
 #!/bin/bash
 set -e
 
-# Fetch the latest docs from source
-
-
 # Ensure the ChromaDB exists locally
 if [ ! -d "db/chroma" ] || [ ! "$(ls -A db/chroma)" ]; then
   echo "No ChromaDB found. Generating embeddings..."