Skip to content

Commit d240942

Browse files
ribbybibbyribbybibby
authored
Add demo scripts to trainer development python example. (#21)
Add a couple of demo magic scripts that talk through the examples, using diffs to demonstrate the changes we're making at each stage. As part of this I've commented and rearranged a few different blocks so they can be talked about together.
1 parent f97a7e2 commit d240942

7 files changed

Lines changed: 124 additions & 26 deletions

File tree

‎train-the-trainer/developer-track/python-example-1/Dockerfile‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,26 @@
11
FROM cgr.dev/chainguard/python:latest-dev AS dev
22

3+
# The python image on DockerHub includes mariadb packages as standard but we
4+
# need to add them explicitly.
35
USER root
6+
RUN apk add --no-cache mariadb-connector-c-dev mariadb
7+
USER 65532
48

9+
# Install python packages into a virtual environment so they can be easily
10+
# copied into the runtime stage.
511
WORKDIR /app
6-
7-
RUN apk add mariadb-connector-c-dev mariadb
812
RUN python -m venv venv
913
ENV PATH="/app/venv/bin":$PATH
10-
11-
# Install python packages
12-
RUN pip install --upgrade pip setuptools wheel && \
13-
pip install --no-cache-dir mysqlclient
14+
COPY requirements.txt requirements.txt
15+
RUN pip install --no-cache-dir -r requirements.txt
1416

1517
FROM cgr.dev/chainguard/python:latest
1618

19+
# Copy virtual environment into the runtime stage.
1720
WORKDIR /app
18-
19-
COPY run.py run.py
2021
COPY --from=dev /app/venv /app/venv
22+
ENV PATH="/app/venv/bin":$PATH
2123

22-
ENV PATH="/app/venv/bin:$PATH"
24+
COPY run.py run.py
2325

2426
ENTRYPOINT ["python", "run.py"]

‎train-the-trainer/developer-track/python-example-1/demo.sh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#! env bash
2+
3+
. ../../base.sh
4+
5+
for i in $(docker images -q python-example-1); do
6+
docker rmi $i
7+
done
8+
9+
clear
10+
11+
banner "Here's a simple python application and its Dockerfile."
12+
pe "$BATCAT run.py"
13+
pe "$BATCAT not-linky.Dockerfile"
14+
15+
banner "Build the image and run it."
16+
pe "docker build -t python-example-1:not-linky -f not-linky.Dockerfile ."
17+
pe "docker run --rm python-example-1:not-linky"
18+
19+
banner "Check the size."
20+
pe "docker images python-example-1"
21+
22+
banner "And the vulnerabilities."
23+
pe "grype python-example-1:not-linky"
24+
25+
banner "Let's migrate it to a Chainguard image."
26+
pe "git diff --no-index -U1000 not-linky.Dockerfile Dockerfile"
27+
pe "docker build -t python-example-1:linky ."
28+
29+
banner "It should be signficantly smaller."
30+
pe "docker images python-example-1"
31+
32+
banner "And it should have a lot less CVEs."
33+
pe "grype python-example-1:linky"
34+
35+
banner "However, when we try to run it..."
36+
pe "docker run --rm python-example-1:linky"

‎train-the-trainer/developer-track/python-example-1/not-linky.Dockerfile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
FROM python:latest
2+
3+
COPY requirements.txt requirements.txt
4+
RUN pip install --no-cache-dir -r requirements.txt
5+
6+
COPY run.py run.py
7+
8+
ENTRYPOINT ["python", "run.py"]

‎train-the-trainer/developer-track/python-example-1/run.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
from MySQLdb import _mysql
2-
print(_mysql.__version__)
2+
print(_mysql.__version__)

‎train-the-trainer/developer-track/python-example-2/Dockerfile‎

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,34 @@
11
FROM cgr.dev/chainguard/python:latest-dev AS dev
2-
WORKDIR /app
3-
# Provide the list of packages that need to be deployed in the distroless image
4-
ENV APK_LIST="mariadb-connector-c-dev mariadb"
5-
USER root
62

7-
# Install specified packages during the build stage
8-
# Comment out or remove if specified system-level packages do not need to be present during the build stage
9-
RUN apk add --no-cache ${APK_LIST}
3+
# The python image on DockerHub includes mariadb packages as standard but we
4+
# need to add them explicitly.
5+
USER root
6+
RUN apk add --no-cache mariadb-connector-c-dev mariadb
107

118
# Install the packages into a root derived from the distroless image.
129
COPY --from=cgr.dev/chainguard/python:latest / /base-chroot
13-
RUN apk add --no-commit-hooks --no-cache --root /base-chroot ${APK_LIST}
10+
RUN apk add --no-commit-hooks --no-cache --root /base-chroot mariadb-connector-c-dev mariadb
1411

1512
USER 65532
1613

17-
# Install desired Python packages
14+
# Install python packages into a virtual environment so they can be easily
15+
# copied into the runtime stage.
16+
WORKDIR /app
1817
RUN python -m venv venv
1918
ENV PATH="/app/venv/bin":$PATH
20-
21-
# Install python packages
22-
COPY requirements.txt /app/
23-
RUN pip install --upgrade pip setuptools wheel && \
24-
pip install --no-cache-dir -r /app/requirements.txt
19+
COPY requirements.txt requirements.txt
20+
RUN pip install --no-cache-dir -r requirements.txt
2521

2622
FROM cgr.dev/chainguard/python:latest
2723

2824
# Replace the filesystem with the one containing the additional packages.
2925
COPY --from=dev /base-chroot /
3026

27+
# Copy virtual environment into the runtime stage.
3128
WORKDIR /app
3229
COPY --from=dev /app/venv /app/venv
33-
COPY run.py run.py
30+
ENV PATH="/app/venv/bin":$PATH
3431

35-
ENV PATH="/app/venv/bin:$PATH"
32+
COPY run.py run.py
3633

3734
ENTRYPOINT ["python", "run.py"]

‎train-the-trainer/developer-track/python-example-2/copyso.Dockerfile‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
FROM cgr.dev/chainguard/python:latest-dev AS dev
2+
3+
# The python image on DockerHub includes mariadb packages as standard but we
4+
# need to add them explicitly.
5+
USER root
6+
RUN apk add --no-cache mariadb-connector-c-dev mariadb
7+
USER 65532
8+
9+
# Install python packages into a virtual environment so they can be easily
10+
# copied into the runtime stage.
11+
WORKDIR /app
12+
RUN python -m venv venv
13+
ENV PATH="/app/venv/bin":$PATH
14+
COPY requirements.txt requirements.txt
15+
RUN pip install --no-cache-dir -r requirements.txt
16+
17+
FROM cgr.dev/chainguard/python:latest
18+
19+
# Copy the required .so from the dev stage into the runtime stage.
20+
COPY --from=dev /usr/lib/libmariadb.so* /usr/lib/
21+
22+
# Copy virtual environment into the runtime stage.
23+
WORKDIR /app
24+
COPY --from=dev /app/venv /app/venv
25+
ENV PATH="/app/venv/bin":$PATH
26+
27+
COPY run.py run.py
28+
29+
ENTRYPOINT ["python", "run.py"]

‎train-the-trainer/developer-track/python-example-2/demo.sh‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#! env bash
2+
3+
. ../../base.sh
4+
5+
for i in $(docker images -q python-example-2); do
6+
docker rmi $i
7+
done
8+
9+
clear
10+
11+
banner "We can fix the error in the previous example by copying the required .so into the runtime stage."
12+
pe "git diff --no-index -U1000 ../python-example-1/Dockerfile copyso.Dockerfile"
13+
14+
banner "Build and run it."
15+
pe "docker build -t python-example-2:copyso -f copyso.Dockerfile ."
16+
pe "docker run --rm python-example-2:copyso"
17+
18+
banner "A more stable alternative is the base-chroot method."
19+
pe "git diff --no-index -U1000 copyso.Dockerfile Dockerfile"
20+
21+
banner "Build and run it."
22+
pe "docker build -t python-example-2:base-chroot ."
23+
pe "docker run --rm python-example-2:base-chroot"
24+
25+
banner "The image will be larger because it includes all the files from the mariadb packages."
26+
pe "docker images python-example-2"

0 commit comments

Comments
 (0)