feat: secure, small, multi-stage Dockerfile

[pfarikrispy]

• separate build into stage
• isolate base image and apt-get
• isolate the app build
• copy only the app into a secure Chainguard Python image that's updated frequently
• group stmnts for less layers
• use image tag SHAs for more (supply chain) security
• make non-root user explicit in final stage
• smaller image that's also more secure

[coveralls]

coverage: 90.54% (+0.9%) from 89.619%
when pulling 3030521 on pfarikrispy:multistage
into f01e5ec on chiefonboarding:master.

[GDay]

Thanks! First time hearing about chainguard, looks good. One question before I merge this.

[GDay]

Shouldn't this be 3.13 instead of latest? It looks like latest will download python 3.14?

[pfarikrispy]

Yes you are right. Latest will fetch 3.14, which is the latest and has all the security fixes. However... Chainguard gives you almost daily free builds with any new cve resolved. But you cannot pin the version. For that you need a license. Using chainguard gives you the most secure minimal base image for the binary, but you will have to make the code work with the latest python version. It's a trade off. I believe Google has a special zero-cve or secure version of python as well. I'll have to look for it. They've hardened 250 or so essential open source containers so projects can build more secure images. Christian.

…

On Wed, Nov 26, 2025, 02:12 Stan Triepels ***@***.***> wrote: ***@***.**** commented on this pull request. Thanks! First time hearing about chainguard, looks good. One question before I merge this. ------------------------------ In back/Dockerfile <#596 (comment)> : > RUN pipenv install --system RUN django-admin compilemessages -CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"] +# checkov:skip=CKV_DOCKER_7: zero-CVE fresh image every build +FROM ***@***.***:136aad7020e00a98f617f3d3343cc7601b7823405eb2bc581eae5f5a8c21e8d0 Shouldn't this be 3.13 instead of latest? It looks like latest will download python 3.14? — Reply to this email directly, view it on GitHub <#596 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC622W75SH25UCSHKM7RXGD36T47ZAVCNFSM6AAAAACMZNSQTGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZTKMBXG42DONRUHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>