-
Notifications
You must be signed in to change notification settings - Fork 945
Solution #1011
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Solution #1011
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| .git | ||
| __pycache__ | ||
| *.pyc | ||
| venv | ||
| .env | ||
| db.sqlite3 | ||
| static | ||
| media |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| FROM python:3.12-slim | ||
| LABEL maintainer="your_email@example.com" | ||
|
|
||
| ENV PYTHONUNBUFFERED 1 | ||
| WORKDIR /app | ||
|
|
||
| RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| libpq-dev \ | ||
| bash \ | ||
| gosu \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| COPY requirements.txt . | ||
|
|
||
| RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| gcc \ | ||
| libc6-dev \ | ||
| && pip install --no-cache-dir -r requirements.txt \ | ||
| && apt-get purge -y --auto-remove gcc libc6-dev \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
Garichka marked this conversation as resolved.
Comment on lines
+16
to
+22
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This RUN correctly installs |
||
|
|
||
| RUN adduser --disabled-password --no-create-home --shell /bin/bash django-user && \ | ||
| mkdir -p /vol/web/media /vol/web/static && \ | ||
| chown -R django-user:django-user /vol && \ | ||
| chmod -R 755 /vol | ||
|
Comment on lines
+24
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. You create |
||
|
|
||
| COPY . . | ||
| RUN chown -R django-user:django-user /app | ||
|
|
||
| COPY ./scripts/entrypoint.sh /entrypoint.sh | ||
| RUN chmod +x /entrypoint.sh | ||
|
|
||
| ENTRYPOINT ["/entrypoint.sh"] | ||
|
Comment on lines
+32
to
+35
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. You copy the entrypoint and set it as ENTRYPOINT here. Verify the entrypoint script executes the whole command chain under the intended user. Avoid a pattern like |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| import time | ||
|
Garichka marked this conversation as resolved.
|
||
| from django.db import connections | ||
| from django.db.utils import OperationalError | ||
| from django.core.management.base import BaseCommand, CommandError | ||
|
|
||
|
|
||
| class Command(BaseCommand): | ||
| def handle(self, *args, **options): | ||
| self.stdout.write("Waiting for database...") | ||
| attempts = 0 | ||
| max_attempts = 20 | ||
|
|
||
|
Garichka marked this conversation as resolved.
Comment on lines
+7
to
+12
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. You install |
||
| while attempts < max_attempts: | ||
|
Garichka marked this conversation as resolved.
|
||
| try: | ||
| db_conn = connections["default"] | ||
| db_conn.cursor() | ||
| self.stdout.write(self.style.SUCCESS( | ||
| f"Database available after {attempts + 1} attempt(s)!" | ||
|
Garichka marked this conversation as resolved.
|
||
| )) | ||
| return | ||
| except OperationalError: | ||
|
Garichka marked this conversation as resolved.
Garichka marked this conversation as resolved.
|
||
| attempts += 1 | ||
|
Comment on lines
+16
to
+22
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This RUN installs |
||
| self.stdout.write( | ||
| f"Database unavailable " | ||
| f"(attempt {attempts}/{max_attempts}), waiting 1s..." | ||
| ) | ||
| time.sleep(1) | ||
|
Comment on lines
+24
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Chowning |
||
|
|
||
| raise CommandError("Database unavailable after maximum attempts.") | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| version: "3.8" | ||
|
|
||
| services: | ||
| db: | ||
| image: postgres:15-alpine | ||
| volumes: | ||
| - postgres_data:/var/lib/postgresql/data | ||
| environment: | ||
| - POSTGRES_DB=cinema | ||
|
Comment on lines
+6
to
+9
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This line sequence uses
Comment on lines
+6
to
+9
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The entrypoint doesn't forward/exec provided arguments, so commands like |
||
| - POSTGRES_USER=postgres | ||
| - POSTGRES_PASSWORD=postgres | ||
|
|
||
| app: | ||
| build: . | ||
| ports: | ||
| - "8000:8000" | ||
| volumes: | ||
| - media_data:/vol/web/media | ||
| - static_data:/vol/web/static | ||
|
Garichka marked this conversation as resolved.
Comment on lines
+17
to
+19
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Named volumes for media/static are created here, but Docker creates new volumes as root by default. Ensure you change ownership at container startup (in the entrypoint) before dropping privileges so |
||
| environment: | ||
| - DB_HOST=db | ||
| - DB_NAME=cinema | ||
| - DB_USER=postgres | ||
| - DB_PASS=postgres | ||
| - ALLOWED_HOSTS=127.0.0.1,localhost | ||
| - DEBUG=False | ||
| depends_on: | ||
| - db | ||
|
Garichka marked this conversation as resolved.
Garichka marked this conversation as resolved.
|
||
|
|
||
| volumes: | ||
| postgres_data: | ||
| media_data: | ||
| static_data: | ||
|
Garichka marked this conversation as resolved.
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,3 +8,4 @@ djangorestframework | |
| djangorestframework-simplejwt | ||
| drf-spectacular | ||
| Pillow | ||
| psycopg2-binary>=2.9.9 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| #!/bin/bash | ||
| set -e | ||
|
|
||
| chown -R django-user:django-user /vol/web | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This |
||
|
|
||
| exec gosu django-user python manage.py wait_for_db && \ | ||
| python manage.py migrate && \ | ||
| python manage.py collectstatic --no-input && \ | ||
| python manage.py runserver 0.0.0.0:8000 | ||
|
Comment on lines
+6
to
+9
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Using |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You install
libpq-devin this RUN and never remove it. That leaves build-time libraries in the final image and violates the requirement to keep images thin. Install build dependencies (libpq-dev, gcc, libc6-dev, etc.) and runpip install -r requirements.txt, then purge the build deps in the same RUN (or use a multi-stage build /psycopg2-binary) so they are not present in the final image layer.