54 lines
1.6 KiB
Docker
54 lines
1.6 KiB
Docker
|
# ---- 构建阶段 ----
|
|||
|
|
FROM python:3.12-slim AS builder
|
|||
|
|
|
|||
|
|
WORKDIR /app
|
|||
|
|
|
|||
|
|
# 系统依赖：python-magic、ClamAV 客户端、编译工具
|
|||
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|||
|
|
libmagic1 libmagic-dev \
|
|||
|
|
clamav clamav-daemon \
|
|||
|
|
&& rm -rf /var/lib/apt/lists/*
|
|||
|
|
|
|||
|
|
COPY requirements.txt .
|
|||
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|||
|
|
|
|||
|
|
# ---- 运行阶段 ----
|
|||
|
|
FROM python:3.12-slim
|
|||
|
|
|
|||
|
|
WORKDIR /app
|
|||
|
|
|
|||
|
|
# 系统运行时依赖
|
|||
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|||
|
|
libmagic1 clamav clamav-daemon ca-certificates \
|
|||
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|||
|
|
&& groupadd -r meshsafe && useradd -r -g meshsafe -d /app meshsafe
|
|||
|
|
|
|||
|
|
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
|
|||
|
|
COPY --from=builder /usr/local/bin /usr/local/bin
|
|||
|
|
|
|||
|
|
# 应用代码
|
|||
|
|
COPY app/ ./app/
|
|||
|
|
COPY config/policy.yaml ./config/policy.yaml
|
|||
|
|
COPY config/diagnostics.yaml ./config/diagnostics.yaml
|
|||
|
|
COPY scripts/ ./scripts/
|
|||
|
|
COPY static/ ./static/
|
|||
|
|
COPY tests/ ./tests/
|
|||
|
|
|
|||
|
|
# 日志目录、临时目录
|
|||
|
|
RUN mkdir -p /var/log/meshsafe /tmp/meshsafe /app/rules \
|
|||
|
|
&& chown -R meshsafe:meshsafe /app /var/log/meshsafe /tmp/meshsafe
|
|||
|
|
|
|||
|
|
ENV PYTHONUNBUFFERED=1 \
|
|||
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|||
|
|
MESHSAFE_LOG_DIR=/var/log/meshsafe \
|
|||
|
|
MESHSAFE_TEMP_ROOT=/tmp/meshsafe
|
|||
|
|
|
|||
|
|
USER meshsafe
|
|||
|
|
|
|||
|
|
EXPOSE 8443
|
|||
|
|
|
|||
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|||
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8443/api/v1/health', timeout=3).read()" || exit 1
|
|||
|
|
|
|||
|
|
CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port 8443 --workers ${UVICORN_WORKERS:-1}"]
|