busya
1e61f098bd
Backend entrypoint sources certs.sh for CA certificate installation,
but the file was never copied into the Docker image — causing
container crash loop on startup (regression in 8fd23f7e).
Changes:
- docker/backend.Dockerfile, docker/all-in-one.Dockerfile: COPY certs.sh
- docker/backend.entrypoint.sh: remove dead install_llm_ca_certs,
install_certificates (replaced by docker/certs.sh); update @INVARIANT
- backend/src/core/ssl.py: fix describe_context() to report actual
system cert count (SSLContext.capath attr does not exist in Python 3)
- __tests__: rewrite stale tests asserting LLM_SSL_VERIFY=false →
verify=False; behaviour is permanently removed — always CERT_REQUIRED
- backend/tests/integration/test_backend_container.py [new]: 5 tests
verifying certs.sh presence, sourceability, and full-stack smoke
(testcontainers PG → entrypoint → migrations → health)
- conftest.py: restore health-wait loop and fixtures in superset_container
- ADR-0009, README.md, scripts, .env: align docs with centralized SSL
45 lines
1.8 KiB
Docker
45 lines
1.8 KiB
Docker
# #region docker.backend.Dockerfile [C:3] [TYPE Module] [SEMANTICS docker,backend,build]
|
||
# @BRIEF Backend Dockerfile — Python 3.11 slim + Playwright + entrypoint с установкой сертификатов.
|
||
# @LAYER Infrastructure
|
||
# @RELATION DEPENDS_ON -> [EXT:path:docker/backend.entrypoint.sh]
|
||
# @RELATION DEPENDS_ON -> [EXT:path:backend/requirements.txt]
|
||
# @PRE Docker builder context — корень проекта. backend/ и docker/ доступны.
|
||
# @POST Образ с backend API, Playwright, entrypoint для bootstrap admin и установки сертификатов.
|
||
|
||
FROM python:3.11-slim
|
||
|
||
ENV PYTHONDONTWRITEBYTECODE=1
|
||
ENV PYTHONUNBUFFERED=1
|
||
ENV BACKEND_PORT=8000
|
||
|
||
WORKDIR /app
|
||
|
||
# Системные зависимости: ca-certificates для корп. сертификатов, libnss3-tools
|
||
# для установки CA в NSS базу Chromium, curl, git для Playwright/GitPython
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
ca-certificates \
|
||
curl \
|
||
git \
|
||
libnss3-tools \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# Python зависимости — backend runtime (agent/ML deps excluded)
|
||
COPY backend/requirements-backend.txt /app/backend/requirements-backend.txt
|
||
RUN pip install --no-cache-dir -r /app/backend/requirements-backend.txt
|
||
RUN python -m playwright install --with-deps chromium
|
||
|
||
# Исходный код
|
||
COPY backend/ /app/backend/
|
||
|
||
# Копируем shared certs.sh и entrypoint — установит корп. сертификаты, Playwright и сделает bootstrap admin
|
||
COPY docker/certs.sh /app/certs.sh
|
||
COPY docker/backend.entrypoint.sh /app/entrypoint.sh
|
||
RUN chmod +x /app/entrypoint.sh
|
||
|
||
WORKDIR /app/backend
|
||
|
||
EXPOSE 8000
|
||
|
||
ENTRYPOINT ["/app/entrypoint.sh"]
|
||
CMD ["python", "-m", "uvicorn", "src.app:app", "--host", "0.0.0.0", "--port", "8000"]
|
||
# #endregion docker.backend.Dockerfile |