Skip to content

[DCP Deployment] Update Dockerfile for UV pinning & nonroot access #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gmechali wants to merge 3 commits into
base: main
Choose a base branch
from
Open

[DCP Deployment] Update Dockerfile for UV pinning & nonroot access #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2263e9f
Pin uv and use non-root user.
gmechali Mar 12, 2026
e5c7a88
Updates the cloudbuild sha
gmechali Mar 12, 2026
958dc83
Address gemini comment
gmechali Mar 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions build/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
FROM python:3.12-slim

# Install uv.
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
# Install uv. Pinning version for reproducibility.
COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /bin/uv

# Set working directory
WORKDIR /app
Expand All @@ -12,15 +12,17 @@ COPY pyproject.toml uv.lock ./
# Copy the package directories
COPY packages/ ./packages/

# Install the dependencies, strictly from the lockfile
RUN uv sync --frozen --no-dev --no-install-project

# Install the project itself
# Install the dependencies and the project itself
# uv sync --frozen installs everything from the lockfile.
RUN uv sync --frozen --no-dev

# Place the virtualenv in the PATH
ENV PATH="/app/.venv/bin:$PATH"

# Create a non-root user and switch to it for security
RUN groupadd -r -g 1001 datacommons-runner && useradd -r -g 1001 -u 1001 datacommons-runner
USER datacommons-runner

# Expose the API port
EXPOSE 5000

Expand Down
4 changes: 2 additions & 2 deletions build/cloudbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@ steps:
- '-t'
- 'us-docker.pkg.dev/datcom-ci/gcr.io/datacommons-platform:latest'
- '-t'
- 'us-docker.pkg.dev/datcom-ci/gcr.io/datacommons-platform:$COMMIT_SHA'
- 'us-docker.pkg.dev/datcom-ci/gcr.io/datacommons-platform:$SHORT_SHA'
- '-f'
- 'build/Dockerfile'
- '.'

images:
- 'us-docker.pkg.dev/datcom-ci/gcr.io/datacommons-platform:latest'
- 'us-docker.pkg.dev/datcom-ci/gcr.io/datacommons-platform:$COMMIT_SHA'
- 'us-docker.pkg.dev/datcom-ci/gcr.io/datacommons-platform:$SHORT_SHA'
Loading