algorithm-exercises-py/Dockerfile at main · sir-gon/algorithm-exercises-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
ARG BASE_IMAGE=python:3.14.5-alpine3.23

###############################################################################
FROM ${BASE_IMAGE} AS init

ENV WORKDIR=/app
WORKDIR ${WORKDIR}

RUN  apk add --update --no-cache make \
  && apk upgrade --update --no-cache expat libexpat # CVE-2024-45491 SNYK-ALPINE320-EXPAT-7908298

###############################################################################
FROM init AS base

ENV WORKDIR=/app
WORKDIR ${WORKDIR}

COPY ./Makefile ${WORKDIR}/
COPY ./requirements.txt ${WORKDIR}/
RUN make dependencies

###############################################################################
FROM base AS lint

ENV WORKDIR=/app
WORKDIR ${WORKDIR}

RUN  apk add --update --no-cache make nodejs npm \
  && apk add --update --no-cache yamllint \
  && npm install -g --ignore-scripts markdownlint-cli@0.47.0 \
  && npm install -g --ignore-scripts prettier@3.7.4

# [!TIP] Use a bind-mount to "/app" to override following "copys"
# for lint and test against "current" sources in this stage

# YAML sources
COPY ./.github ${WORKDIR}/
COPY ./compose.yaml ${WORKDIR}/

# Markdown sources
COPY ./docs ${WORKDIR}/
COPY ./README.md ${WORKDIR}/
COPY ./LICENSE.md ${WORKDIR}/
COPY ./CODE_OF_CONDUCT.md ${WORKDIR}/

# Code source
COPY ./src/ ${WORKDIR}/src
COPY ./requirements.txt ${WORKDIR}/
COPY ./setup.cfg ${WORKDIR}/
COPY ./Makefile ${WORKDIR}/

# code linting conf
COPY ./.pylintrc ${WORKDIR}/
COPY ./.coveragerc ${WORKDIR}/
COPY ./setup.cfg ${WORKDIR}/

# markdownlint conf
COPY ./.markdownlint.yaml ${WORKDIR}/

# yamllint conf
COPY ./.yamllint ${WORKDIR}/
COPY ./.yamlignore ${WORKDIR}/

# JSON linting conf
COPY ./.prettierrc.yaml ${WORKDIR}/

CMD ["make", "lint"]

###############################################################################
FROM base AS development

COPY ./Makefile ${WORKDIR}/
COPY ./setup.cfg ${WORKDIR}/
COPY ./src/ ${WORKDIR}/src

RUN ls -alh

# CMD []

###############################################################################
FROM development AS builder

RUN apk add --update --no-cache rsync

ENV WORKDIR=/app
WORKDIR ${WORKDIR}

RUN rsync -av --prune-empty-dirs \
  --exclude '*_test.py' \
  --exclude '*.pyc' \
  --exclude '.venv' \
  --exclude '__pycache__' \
  src/ build/

# CMD []

###############################################################################
### In testing stage, can't use USER, due permissions issue
## in github actions environment:
##
## https://docs.github.com/en/actions/creating-actions/dockerfile-support-for-github-actions
##
FROM builder AS testing

ENV LOG_LEVEL=INFO
ENV BRUTEFORCE=false

WORKDIR /app

COPY ./.coveragerc ${WORKDIR}/
COPY ./setup.cfg ${WORKDIR}/

RUN ls -alh

CMD ["make", "test"]

###############################################################################
### In production stage
## in the production phase, "good practices" such as
## WORKDIR and USER are maintained
##
FROM init AS production

ENV LOG_LEVEL=INFO
ENV BRUTEFORCE=false
ENV WORKDIR=/app
WORKDIR ${WORKDIR}

RUN  adduser -D worker \
  && mkdir -p /app \
  && chown worker:worker /app

COPY ./Makefile ${WORKDIR}/

COPY --from=builder /app/build/ ${WORKDIR}/

RUN ls -alh

USER worker
CMD ["make", "run"]

# checkov:skip= CKV_DOCKER_2: production image isn't a service process (yet)