finnandClaude Opus 5.5
c72bc8c6af
Gunicorn 25.1+ creates a control socket under $HOME/.gunicorn, which fails in the read-only container without a home directory and logs "Control server error". The socket is not used. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.3 KiB
Docker
43 lines
1.3 KiB
Docker
# Build stage: compile the wheels (psycopg2 needs gcc and libpq-dev)
|
|
FROM python:3.15-slim-trixie AS build
|
|
|
|
RUN apt-get update && \
|
|
apt-get install --no-install-recommends -y gcc libc-dev libpq-dev && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /build
|
|
COPY requirements.txt .
|
|
RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
|
|
|
|
# Runtime stage: no compiler and no tools besides what db-setup.sh needs
|
|
FROM python:3.15-slim-trixie
|
|
|
|
RUN apt-get update && apt-get upgrade -y && \
|
|
apt-get install --no-install-recommends -y libpq5 postgresql-client wait-for-it && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=build /wheels /wheels
|
|
RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
|
|
|
|
RUN groupadd --system --gid 10001 max && \
|
|
useradd --system --uid 10001 --gid max --no-create-home --shell /usr/sbin/nologin max
|
|
|
|
WORKDIR /app
|
|
|
|
ENV PYTHONPATH=/app/
|
|
ENV FLASK_APP=max.app
|
|
# Refuses to start in debug mode, see max/app.py
|
|
ENV MAX_PRODUCTION=1
|
|
|
|
# Owned by root, so the app cannot modify its own code
|
|
COPY max/ ./max
|
|
COPY scripts/prod/ .
|
|
COPY VERSION .
|
|
# Precompile, since the app cannot write __pycache__ at runtime
|
|
RUN python -m compileall -q max
|
|
|
|
USER max
|
|
|
|
ENTRYPOINT ["./entrypoint.sh"]
|
|
CMD ["gunicorn", "-w", "1", "-b", "0.0.0.0:8000", "--no-control-socket", "max.app:app"]
|