busya
1e61f098bd
Backend entrypoint sources certs.sh for CA certificate installation,
but the file was never copied into the Docker image — causing
container crash loop on startup (regression in 8fd23f7e).
Changes:
- docker/backend.Dockerfile, docker/all-in-one.Dockerfile: COPY certs.sh
- docker/backend.entrypoint.sh: remove dead install_llm_ca_certs,
install_certificates (replaced by docker/certs.sh); update @INVARIANT
- backend/src/core/ssl.py: fix describe_context() to report actual
system cert count (SSLContext.capath attr does not exist in Python 3)
- __tests__: rewrite stale tests asserting LLM_SSL_VERIFY=false →
verify=False; behaviour is permanently removed — always CERT_REQUIRED
- backend/tests/integration/test_backend_container.py [new]: 5 tests
verifying certs.sh presence, sourceability, and full-stack smoke
(testcontainers PG → entrypoint → migrations → health)
- conftest.py: restore health-wait loop and fixtures in superset_container
- ADR-0009, README.md, scripts, .env: align docs with centralized SSL
68 lines
2.3 KiB
Docker
68 lines
2.3 KiB
Docker
# ============================================================
|
|
# All-in-One Docker image (no Playwright, <200MB target)
|
|
# ============================================================
|
|
# Build: docker build -f docker/all-in-one.Dockerfile -t superset-tools:latest .
|
|
# Run: docker run -p 8000:8000 --env-file backend/.env superset-tools:latest
|
|
#
|
|
# Stages:
|
|
# 1. frontend-builder — node:20-alpine, npm ci + build, discarded
|
|
# 2. runtime — python:3.11-slim, backend deps (no playwright),
|
|
# copies frontend build, uvicorn serves both SPA + API on :8000
|
|
|
|
# ── Stage 1: Build Frontend ────────────────────────────────
|
|
FROM node:20-alpine AS frontend-builder
|
|
ARG APP_VERSION=0.0.0
|
|
ENV APP_VERSION=${APP_VERSION}
|
|
|
|
WORKDIR /app/frontend
|
|
|
|
# Install deps (layer cache when package.json unchanged)
|
|
COPY frontend/package.json frontend/package-lock.json* ./
|
|
RUN npm ci --prefer-offline --no-audit --no-fund --legacy-peer-deps
|
|
|
|
# Build frontend
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# ── Stage 2: Runtime ───────────────────────────────────────
|
|
FROM python:3.11-slim AS runtime
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
BACKEND_PORT=8000 \
|
|
DEBIAN_FRONTEND=noninteractive
|
|
|
|
WORKDIR /app
|
|
|
|
# System deps (git for GitPython, curl for healthcheck)
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
curl \
|
|
git \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Python deps (NO playwright — saves ~350MB)
|
|
COPY backend/requirements-backend.txt /app/backend/requirements-backend.txt
|
|
RUN pip install --no-cache-dir -r /app/backend/requirements-backend.txt
|
|
|
|
# Backend source
|
|
COPY backend/ /app/backend/
|
|
|
|
# Frontend build (from stage 1)
|
|
COPY --from=frontend-builder /app/frontend/build /app/frontend/build
|
|
|
|
# Entrypoint + certs.sh
|
|
COPY docker/certs.sh /app/certs.sh
|
|
COPY docker/backend.entrypoint.sh /app/entrypoint.sh
|
|
RUN chmod +x /app/entrypoint.sh
|
|
|
|
WORKDIR /app/backend
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD curl -sf http://localhost:8000/ || exit 1
|
|
|
|
ENTRYPOINT ["/app/entrypoint.sh"]
|
|
CMD ["python", "-m", "uvicorn", "src.app:app", "--host", "0.0.0.0", "--port", "8000"]
|