mirror of
https://github.com/suitenumerique/messages.git
synced 2026-10-20 15:21:33 +02:00
Jean-Baptiste PENRATHandGitHub
536aa80c0e
A critical security vulnerability was reported on CPython 3.14.7, so every image built on the shared python-uv base must run 3.14.8. The requires-python floor of backend and mta-in is raised accordingly so an older interpreter can no longer be used by mistake. uv is bumped to 0.12.24 because 0.12.13 does not know the 3.14.8 download and the base image build failed.
53 lines
2.1 KiB
Docker
53 lines
2.1 KiB
Docker
# Shared Python base image — the single source of truth for the Debian base, the
|
|
# uv version, and the uv-managed CPython version used by every uv-based Python
|
|
# service (backend, mta-in, and the mta-in pymta variant).
|
|
#
|
|
# Built + published by `make build-python-base` (locally, tagged
|
|
# `messages-python-uv:local`) and by the `python-uv` job in messages-ghcr.yml
|
|
# (multi-arch, pushed to ghcr). Services consume it via the build arg
|
|
# PYTHON_UV_IMAGE and do `FROM ${PYTHON_UV_IMAGE} AS uv` — see compose.yaml
|
|
# `build.args` and the CI `build-args` input.
|
|
#
|
|
# Deliberately MINIMAL: no build-essential here, because the MTA runtimes inherit
|
|
# this image directly and we don't want compilers in production images. Each
|
|
# service adds its own build deps in a build-only stage.
|
|
|
|
FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS base
|
|
|
|
# Bump to force an apt refresh + security upgrade of the base OS.
|
|
ENV MIN_UPDATE_DATE="2026-10-05"
|
|
|
|
RUN <<EOR
|
|
apt-get update
|
|
DEBIAN_FRONTEND="noninteractive" apt-get upgrade -y
|
|
DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
|
|
ca-certificates
|
|
rm -rf /var/lib/apt/lists/*
|
|
EOR
|
|
|
|
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1
|
|
|
|
WORKDIR /app
|
|
|
|
# ---- uv + managed Python ----
|
|
FROM base AS uv
|
|
|
|
# Pin uv by SHA256 digest for supply chain security.
|
|
# Verify with: gh attestation verify --owner astral-sh oci://ghcr.io/astral-sh/uv:0.12.24
|
|
COPY --from=ghcr.io/astral-sh/uv@sha256:3af4716e991d6956a41e573eab705d0ee08500cd829ed30293eb8472f372c65a /uv /uvx /bin/
|
|
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
ENV UV_LINK_MODE=copy
|
|
ENV UV_PYTHON_PREFERENCE=only-managed
|
|
ENV UV_PYTHON_INSTALL_DIR=/opt/python
|
|
ENV UV_PROJECT_ENVIRONMENT=/venv
|
|
|
|
# Install Python via uv — integrity verified against SHA256 checksums embedded in
|
|
# the uv binary. python-build-standalone statically links most C deps (ssl, ffi,
|
|
# sqlite, zlib, lzma, bz2).
|
|
RUN uv python install 3.14.8
|
|
|
|
# Prune list for the distroless images, shared by the backend and pymta builds
|
|
# (they run `strip-python` in a stage off this image). Single source of truth.
|
|
COPY --chmod=0755 strip-python.sh /usr/local/bin/strip-python
|