diff --git a/api-server/Dockerfile b/api-server/Dockerfile index 5bc8129..aa115c8 100644 --- a/api-server/Dockerfile +++ b/api-server/Dockerfile @@ -1,5 +1,10 @@ FROM python:3.11-slim-bookworm +# uid to run application +ARG USER=1000 +# gid to run application +ARG USER_GROUP=1000 + # set virtual env path ENV \ PATH=/venv/bin:$PATH @@ -13,11 +18,15 @@ WORKDIR /app # copy app files to /app directory COPY ./app . -# install dependencies +# set permissions to log directory and install dependencies RUN \ + chown -R ${USER}:${USER_GROUP} /app/log && \ python -m venv /venv && \ pip install -r requirements.txt +# set user to run application +USER ${USER}:${USER_GROUP} + # start shell script when container starts ENTRYPOINT ["/app/run.sh"] diff --git a/api-server/Makefile b/api-server/Makefile index 7ff0cad..d9d9fce 100644 --- a/api-server/Makefile +++ b/api-server/Makefile @@ -5,7 +5,6 @@ CONTAINER_NAME=api-server build: clean @docker build \ --progress=plain \ - --no-cache \ --tag $(IMAGE_NAME) \ . diff --git a/multistage-build/Dockerfile b/multistage-build/Dockerfile index 186c491..84af989 100644 --- a/multistage-build/Dockerfile +++ b/multistage-build/Dockerfile @@ -1,5 +1,10 @@ FROM python:3.11-slim-bookworm +# uid to run application +ARG USER=1000 +# gid to run application +ARG USER_GROUP=1000 + # set virtual env path ENV \ PATH=/venv/bin:$PATH @@ -19,11 +24,15 @@ RUN \ # copy app files to /app directory COPY ./app . -# install dependencies && cleanup +# set permissions to log directory and install dependencies && cleanup RUN \ + chown -R ${USER}:${USER_GROUP} /app/log && \ pip install -r requirements.txt && \ apt purge --auto-remove -y +# set user to run application +USER ${USER}:${USER_GROUP} + # start shell script when container starts ENTRYPOINT ["/app/run.sh"] diff --git a/multistage-build/Dockerfile.multistage b/multistage-build/Dockerfile.multistage index 454ab66..12cdf2b 100644 --- a/multistage-build/Dockerfile.multistage +++ b/multistage-build/Dockerfile.multistage @@ -23,6 +23,11 @@ RUN \ FROM python:3.11-slim-bookworm +# uid to run application +ARG USER=1000 +# gid to run application +ARG USER_GROUP=1000 + # set virtual env path ENV \ PATH=/venv/bin:$PATH @@ -38,11 +43,11 @@ COPY --from=install-dependencies /venv /venv # copy app files to /app directory COPY ./app . -RUN ls -alF / -RUN ls -alF /venv -RUN ls -alF /venv/bin -RUN ls -alF /app +# set permissions to log directory +RUN chown -R ${USER}:${USER_GROUP} /app/log +# set user to run application +USER ${USER}:${USER_GROUP} # start shell script when container starts ENTRYPOINT ["/app/run.sh"] diff --git a/multistage-build/Makefile b/multistage-build/Makefile index fa2cdcd..b5a4f67 100644 --- a/multistage-build/Makefile +++ b/multistage-build/Makefile @@ -22,6 +22,7 @@ run: --name $(IMAGE_NAME) \ --publish 3000:3000 \ --env CONTAINER_NAME="Awesome API server" \ + --volume /var/log/api-server:/app/log \ --detach \ $(CONTAINER_NAME)