finnandClaude Opus 5.5
931243dd60
The app ran as root, and the production image contained gcc, vim, wget and gnupg. Code execution in the container would have allowed changing the app code and fetching or compiling further tools. - Multi-stage build: the wheels (psycopg2) are built in a build stage. The runtime image only contains libpq5, postgresql-client and wait-for-it (724 MB -> 298 MB). - The app runs as the system user max (uid/gid 10001). The code is owned by root and precompiled, the user has no writable directory. - Log to stdout only; docker collects it. The log file under /app/log was lost on every container recreation anyway. - docker-compose: read-only filesystem (tmpfs for /tmp), no capabilities, no-new-privileges and log rotation (5 x 10 MB). - Add a .dockerignore and set MAX_ORIGIN in docker-compose.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
30 lines
619 B
Makefile
30 lines
619 B
Makefile
# DEV
|
|
seed-dev: clear-dev
|
|
FLASK_APP=max.app FLASK_DEBUG=1 scripts/dev/seed-db.sh
|
|
|
|
clear-dev:
|
|
scripts/dev/clear-db.sh
|
|
|
|
run-dev:
|
|
FLASK_APP=max.app FLASK_DEBUG=1 flask run --host 0.0.0.0 --port 8757
|
|
|
|
run-dev-as-prod:
|
|
FLASK_APP=max.app MAX_ORIGIN=http://localhost:8757 gunicorn -w 1 -b 0.0.0.0:8757 max.app:app
|
|
|
|
run-cleanup:
|
|
scripts/dev/cleanup.sh
|
|
|
|
# PROD
|
|
build-prod:
|
|
docker build -t max:$(shell cat VERSION) .
|
|
|
|
run-prod:
|
|
docker-compose up -d
|
|
|
|
stop-prod:
|
|
docker-compose down
|
|
|
|
setup-prod-initial-login:
|
|
docker-compose exec max flask add-domain finn.st
|
|
docker-compose exec max flask reset-admin admin@finn.st admin
|