Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions .github/workflows/ci-cd.yml
Original file line number Diff line number Diff line change
Expand Up @@ -151,10 +151,6 @@ jobs:
run: |
flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics > flake8-results.txt 2>&1 || true
LINT_ERRORS=$(grep -c "E9\|F63\|F7\|F82" flake8-results.txt 2>/dev/null || echo "0")

# 안전하게 output 쓰기
echo "lint_errors=${LINT_ERRORS}" >> $GITHUB_OUTPUT
echo "service_name=${{ matrix.service }}" >> $GITHUB_OUTPUT

- name: Run tests with coverage - ${{ matrix.service }}
id: test
Expand Down
38 changes: 0 additions & 38 deletions requirements-dev.txt

This file was deleted.

31 changes: 31 additions & 0 deletions services/painting-surface-data-simulator-service/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
FROM python:3.10

# 작업 디렉토리 설정
WORKDIR /app

# 시스템 패키지 업데이트 및 필요한 패키지 설치
RUN apt-get update && apt-get install -y \
gcc \
&& rm -rf /var/lib/apt/lists/*

# Python 의존성 파일 복사 및 설치
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# 애플리케이션 코드 복사
COPY app/ ./app/

# 환경 설정 파일 복사
COPY .env ./

Comment on lines +18 to +20
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Do not bake .env into the image (secrets exposure).

COPYing .env into the container risks leaking credentials (e.g., Azure keys) via image layers and registries. Pass env at runtime instead (docker run -e, Compose env_file, or orchestrator secrets).

-# 환경 설정 파일 복사
-COPY .env ./
+## 환경 변수/비밀은 런타임에 주입하세요 (Docker run/Compose/K8s Secrets 등)
+# ENV is set by the runtime; do not COPY .env into the image

Follow-ups:

  • Add a .dockerignore to exclude .env, logs/, __pycache__/, .pytest_cache/, etc.
  • Consider a non-root user and a slim base to reduce attack surface.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# 환경 설정 파일 복사
COPY .env ./
## 환경 변수/비밀은 런타임에 주입하세요 (Docker run/Compose/K8s Secrets 등)
# ENV is set by the runtime; do not COPY .env into the image
🤖 Prompt for AI Agents
In services/painting-surface-data-simulator-service/Dockerfile around lines
18-20, do not COPY the .env into the image because it bakes secrets into layers;
remove the "COPY .env ./" line and rely on passing environment variables at
runtime (docker run -e / docker-compose env_file / orchestrator secrets or
secret manager), add a .dockerignore to exclude .env, logs/, __pycache__/,
.pytest_cache/, etc., and as follow-ups consider switching to a slim base image
and creating a non-root user in the Dockerfile to reduce attack surface.

# 로그 디렉토리 생성
RUN mkdir -p logs

# 포트 노출
EXPOSE 8012

# 환경 변수 설정
ENV PYTHONPATH=/app

# 애플리케이션 실행
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8012"]
Loading