Python

1# =============================================================================
2# Python Production Dockerfile
3# =============================================================================
4# Customize the following before use:
5#   - APP_MODULE:  Change the uvicorn target (e.g. "app.main:app" for FastAPI,
6#                  "myproject.wsgi:application" for Django with gunicorn)
7#   - PORT:        Change EXPOSE port if not 8000
8#   - DEPS FILE:   If using Poetry, replace requirements.txt steps with
9#                  "poetry export -f requirements.txt" in the build stage
10#   - ENTRY_POINT: Adjust the final CMD for your framework (gunicorn, uvicorn,
11#                  flask run, etc.)
12# =============================================================================
13
14# ---------------------------------------------------------------------------
15# Stage 1: Build
16# ---------------------------------------------------------------------------
17# Base: latest stable Python, Debian-slim (NOT Alpine — musl breaks many C extensions). See references/base-images.md.
18FROM python:<LATEST_STABLE_PYTHON>-slim AS build
19
20WORKDIR /app
21
22# Create a virtual environment so we can copy it cleanly to the runtime stage
23RUN python -m venv /app/venv
24ENV PATH="/app/venv/bin:$PATH"
25
26# Layer caching: install dependencies before copying source
27COPY requirements.txt ./
28
29RUN pip install --no-cache-dir --upgrade pip \
30    && pip install --no-cache-dir -r requirements.txt
31
32# Copy application source
33COPY . .
34
35# If you have a build step (e.g. Django collectstatic), run it here:
36# RUN python manage.py collectstatic --noinput
37
38# ---------------------------------------------------------------------------
39# Stage 2: Runtime
40# ---------------------------------------------------------------------------
41FROM python:<LATEST_STABLE_PYTHON>-slim
42
43WORKDIR /app
44
45# AKS Deployment Safeguards DS004: create and switch to a non-root user
46RUN groupadd --gid 1000 appuser \
47    && useradd --uid 1000 --gid appuser --shell /bin/sh --create-home appuser
48
49# Copy the virtual environment and application source from the build stage
50COPY --from=build --chown=appuser:appuser /app /app
51
52ENV PATH="/app/venv/bin:$PATH" \
53    PYTHONDONTWRITEBYTECODE=1 \
54    PYTHONUNBUFFERED=1
55
56USER appuser
57
58EXPOSE 8000
59
60# HEALTHCHECK is omitted — Kubernetes liveness/readiness probes handle health
61# checks in AKS. Adding a Dockerfile HEALTHCHECK would require installing curl
62# in the runtime image, increasing size and attack surface.
63
64CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]