2026-10-18 00:54:23 +02:00
|
|
|
# B-91 (SEC-51, SEC-52): base image pinned by digest, dependencies installed from a
|
|
|
|
|
# hash-checked lock file, process running as a non-root user.
|
|
|
|
|
# To update: `docker buildx imagetools inspect python:3.12-slim` for the digest, and
|
|
|
|
|
# `pip-compile --generate-hashes --strip-extras -o requirements.lock pyproject.toml` for the lock.
|
|
|
|
|
FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1
|
2026-07-21 11:14:56 +02:00
|
|
|
|
|
|
|
|
WORKDIR /app
|
|
|
|
|
|
2026-10-18 00:54:23 +02:00
|
|
|
COPY requirements.lock ./
|
|
|
|
|
RUN pip install --no-cache-dir --require-hashes --no-deps -r requirements.lock
|
|
|
|
|
|
2026-07-21 11:14:56 +02:00
|
|
|
COPY pyproject.toml ./
|
|
|
|
|
COPY app ./app
|
|
|
|
|
COPY migrations ./migrations
|
|
|
|
|
COPY alembic.ini ./
|
|
|
|
|
COPY scripts ./scripts
|
|
|
|
|
|
2026-10-18 00:54:23 +02:00
|
|
|
RUN pip install --no-cache-dir --no-deps . \
|
|
|
|
|
&& useradd --uid 1000 --no-create-home --shell /usr/sbin/nologin app
|
|
|
|
|
USER 1000:1000
|
2026-07-21 11:14:56 +02:00
|
|
|
|
|
|
|
|
EXPOSE 8123
|
|
|
|
|
|
2026-10-18 00:54:23 +02:00
|
|
|
# umask 077: the database, its WAL files and the logs are created readable by the app user only.
|
Readiness, Electrum status, audit browsing and logs (B-92, API-37, API-46, API-47, AUD-34, AUD-41, ARC-02, ARC-09, ARC-61, ELC-29, SEC-48)
2026-10-18 01:15:22 +02:00
|
|
|
CMD ["/bin/sh", "-c", "umask 077; test -f \"$MASTER_KEY_PATH\" || { echo \"ERROR: master key not found at $MASTER_KEY_PATH -- run: docker compose run --rm app python scripts/generate_master_key.py\" >&2; exit 1; }; alembic upgrade head && exec uvicorn app.main:app --host 0.0.0.0 --port 8123 --proxy-headers --forwarded-allow-ips \"${FORWARDED_ALLOW_IPS:-127.0.0.1}\""]
|
