#510 add Docker Multi Stage build, slim image from 977 to 561MB, run Containers non-root

Author: justb4

.dockerignore

@@ -1,6 +1,7 @@
 # VCS
 .git
 .gitignore
+.github
 
 # Local pixi environment (built inside the image via `pixi install`)
 .pixi
@@ -10,7 +11,12 @@ instance
 report.md
 docs/_build
 GeoHealthCheck/static/lib
-GeoHealthCheck/data.db
+!GeoHealthCheck/static/lib/jqueryui
+!GeoHealthCheck/static/lib/jspark
+GeoHealthCheck/static/docs
+**/data.db
+*.log
+**/*.log
 
 # Tooling / caches
 .pytest_cache

.gitignore

@@ -58,11 +58,13 @@ instance
 tmp/
 GeoHealthCheck/static/docs
 GeoHealthCheck/static/lib
+!GeoHealthCheck/static/lib/jqueryui
+!GeoHealthCheck/static/lib/jspark
 GeoHealthCheck.wsgi
 GeoHealthCheck.conf
 
 # Data
-GeoHealthCheck/data.db
+data.db
 # test report
 report.md
 

Dockerfile

@@ -1,32 +1,67 @@
-FROM ghcr.io/prefix-dev/pixi:0.72.0-noble
+FROM ghcr.io/prefix-dev/pixi:0.72.2-noble AS build
+
+# ARGS
+ARG LANGUAGE="en_US"
+ARG ENCODING="UTF-8"
+
+ENV LOCALE_STR="${LANGUAGE}.${ENCODING} ${ENCODING}" \
+    DEBIAN_FRONTEND=noninteractive
+
+# Install and Configure default locale
+# NB GHC has its own language handlling via Babel.
+RUN apt update -y \
+    && apt install -y locales \
+    && echo "${LOCALE_STR}" > /etc/locale.gen \
+    && locale-gen \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY . .
+
+RUN pixi install -e prod --locked
+RUN echo '#!/bin/bash' > /app/pixi-env.sh
+RUN pixi shell-hook -e prod -s bash --as-is >> /app/pixi-env.sh
+RUN echo 'exec "$@"' >> /app/pixi-env.sh
+RUN echo chmod +x /app/pixi-env.sh
+RUN pixi run -e prod setup
+RUN cp docker/config_site.py instance/
+RUN if [ -d  docker/plugins ]; then cp -ar docker/plugins/* /app/GeoHealthCheck/plugins/; fi
+
+# Slim down, removing unused files generated within build
+RUN rm -rf /app/GeoHealthCheck/docs
+RUN find /app/GeoHealthCheck/static/lib -type d -name docs | xargs rm -rf
+RUN find /app/GeoHealthCheck/static/lib -type d -name src | xargs rm -rf
+
+FROM ubuntu:24.04 AS production
 
 # Credits to yjacolin for providing first versions
 LABEL original_developer="yjacolin <yves.jacolin@camptocamp.com>" \
 	maintainer="Just van den Broecke <justb4@gmail.com>"
 
+# Copy the compiled locale files from the builder
+COPY --from=build /usr/lib/locale/locale-archive /usr/lib/locale/locale-archive
+COPY --from=build /etc/locale.gen /etc/locale.gen
+COPY --from=build /etc/default/locale /etc/default/locale
+
 # These are default values,
 # Override when running container via docker(-compose)
 
-# ARGS
-ARG TZ="Etc/UTC"
-ARG LANG="en_US.UTF-8"
-ARG ADD_DEB_PACKAGES=""
-
 # General ENV settings
-ENV LC_ALL="en_US.UTF-8" \
-	LANG="en_US.UTF-8" \
-	LANGUAGE="en_US.UTF-8" \
-    \
-	\
-	DEB_PACKAGES="ca-certificates locales postgresql-client" \
-	DEB_BUILD_DEPS="curl adduser" \
+ENV LANG='en_US.UTF-8' \
+    LANGUAGE='en_US:en' \
+    LC_ALL='en_US.UTF-8' \
+    TZ='Etc/UTC' \
+	DEB_PACKAGES="ca-certificates postgresql-client" \
+	DEB_BUILD_DEPS="adduser" \
 	ADMIN_NAME=admin \
 	ADMIN_PWD=admin \
 	ADMIN_EMAIL=admin.istrator@mydomain.com \
-	SQLALCHEMY_DATABASE_URI='sqlite:////GeoHealthCheck/DB/data.db' \
+	SQLALCHEMY_DATABASE_URI='sqlite:////app/instance/DB/data.db' \
 	SQLALCHEMY_ENGINE_OPTION_PRE_PING=False \
 	SECRET_KEY='d544ccc37dc3ad214c09b1b7faaa64c60351d5c8bb48b342' \
-	GHC_HOME=/GeoHealthCheck \
+	GHC_HOME=/app \
+	GHC_USER=ghc \
+	GHC_USER_HOME=/home/ghc \
 	GHC_PROBE_HTTP_TIMEOUT_SECS=30 \
 	GHC_MINIMAL_RUN_FREQUENCY_MINS=10 \
 	GHC_RETENTION_DAYS=30 \
@@ -55,57 +90,39 @@ ENV LC_ALL="en_US.UTF-8" \
 	GHC_GEOIP_LATFIELD='lat' \
 	GHC_GEOIP_LONFIELD='lon' \
 	GHC_METADATA_CACHE_SECS=900 \
-    \
-# WSGI server settings, assumed is gunicorn  \
-HOST=0.0.0.0 \
-PORT=80 \
-WSGI_WORKERS=4 \
-WSGI_WORKER_TIMEOUT=6000 \
-WSGI_WORKER_CLASS='gevent' \
-\
+    HOST=0.0.0.0 \
+    PORT=80 \
+    WSGI_WORKERS=4 \
+    WSGI_WORKER_TIMEOUT=6000 \
+    WSGI_WORKER_CLASS='gevent' \
+    GHC_USER_PLUGINS=''
+
 # GHC Core Plugins modules and/or classes, seldom needed to set:  \
 # if not specified here or in Container environment  \
 # all GHC built-in Plugins will be active.  \
 #ENV GHC_PLUGINS 'GeoHealthCheck.plugins.probe.owsgetcaps,\
 #        GeoHealthCheck.plugins.probe.wms, ...., ...\
 #        GeoHealthCheck.plugins.check.checks' \
-\
-# GHC User Plugins, best be overridden via Container environment \
-GHC_USER_PLUGINS=''
-
-# Add standard files and Add/override Plugins
-# Alternative Entrypoints to run GHC jobs
-# Override default Entrypoint with these on Containers
-COPY docker/scripts/*.sh docker/config_site.py docker/plugins /
 
-# Add Source Code
-COPY . ${GHC_HOME}
-
-WORKDIR ${GHC_HOME}
+# GHC User Plugins, best be overridden via Container environment \
 
 # Install operating system dependencies
 RUN \
-    apt-get update \
-    && apt-get --no-install-recommends install -y ${DEB_PACKAGES} ${DEB_BUILD_DEPS} ${ADD_DEB_PACKAGES} \
-    && localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \
+    apt update \
+    && apt --no-install-recommends install -y ${DEB_PACKAGES} ${DEB_BUILD_DEPS} \
     && echo "For ${TZ} date=$(date)" && echo "Locale=$(locale)"  \
-    && adduser --disabled-password --shell /bin/bash --home ${GHC_HOME} --gecos "User" ghc \
-    && chmod +x /*.sh  \
-    && pixi install --locked -e prod \
-    && pixi run -e prod setup \
-    && cp /config_site.py ${GHC_HOME}/instance/config_site.py \
-    && if [ -d /plugins ]; then cp -ar /plugins/* ${GHC_HOME}/GeoHealthCheck/plugins/; fi && rm -rf /plugins \
-    && apt-get remove --purge -y ${DEB_BUILD_DEPS} \
-    && apt-get clean \
+    && adduser --disabled-password --shell /bin/bash --gecos "User" ${GHC_USER} \
+    && apt remove --purge -y ${DEB_BUILD_DEPS} \
+    && apt clean \
     && apt autoremove -y  \
     && rm -rf /var/lib/apt/lists/*
 
-# For later: run as user 'ghc'
-# USER ghc
+WORKDIR /app
+COPY --from=build --chown=${GHC_USER}:${GHC_USER} /app /app
 
-# For SQLite
-VOLUME ["/GeoHealthCheck/DB/"]
+# For later: run as user 'ghc'
+USER ${GHC_USER}
 
 EXPOSE ${PORT}
 
-ENTRYPOINT /run-web.sh
+ENTRYPOINT [ "/app/docker/scripts/run-web.sh"  ]

docker/README.md

@@ -5,7 +5,7 @@ GHC Docker images are hosted at [Docker Hub](https://hub.docker.com/r/geopython/
 In the best case an install/run of GHC is a matter of minutes!
 
 If you are reading this from Docker Hub, local links will not work. 
-In that case use the [Docker Readme at GHC GitHub](https://github.com/geopython/GeoHealthCheck/blob/master/docker/README.md).
+In that case use the [Docker Readme at GHC GitHub](https://github.com/geopython/geohealthcheck/blob/master/docker/README.md).
 
 Since GHC release 0.4.0 GHC can run completely with two Docker containers from the same
 GHC Docker image:
@@ -15,14 +15,13 @@ GHC Docker image:
 
 ## Requirements
 
-Docker installed and Docker daemon running.
-[Docker Compose](https://docs.docker.com/compose/install) is separate install.
+Docker with Docker Compose installed and Docker daemon running.
 
 For installing Docker on Ubuntu there
 is a  [bash helper script](install-docker-ubuntu.sh).
 
-NB: The ``docker`` commands below may need to be prepended with 
-``sudo``, dependent on your login rights.
+NB: The `docker` commands below may need to be prepended with 
+`sudo`, dependent on your rights to run `docker` commands.
 
 ## Build
 
@@ -43,7 +42,7 @@ For example [run.sh](run.sh) which launches GHC using the robust `gunicorn` WSGI
 ## Run
 
 ```
-docker run -d --name ghc_web --rm -p 8083:80 -v ghc_sqlitedb:/GeoHealthCheck/DB geopython/geohealthcheck:latest
+docker run -d --name ghc_web --rm -p 8083:80 -v ghc_sqlitedb:/app/instance/DB geopython/geohealthcheck:latest
 ```
 
 go to http://localhost:8083 (port 80 in GHC Container is mapped to 8083 on host).
@@ -56,7 +55,7 @@ This mode can be disabled by passing `GHC_RUNNER_IN_WEBAPP` to as an ENV
 var to the Docker container:
 
 ```
-docker run  --name ghc_web --rm -e GHC_RUNNER_IN_WEBAPP=False -p 8083:80 -v ghc_sqlitedb:/GeoHealthCheck/DB geopython/geohealthcheck:latest
+docker run  --name ghc_web --rm -e GHC_RUNNER_IN_WEBAPP=False -p 8083:80 -v ghc_sqlitedb:/app/instance/DB geopython/geohealthcheck:latest
 
 ```
 
@@ -66,7 +65,13 @@ You can then run `GHC Runner` as a separate container by overriding
 the default `ENTRYPOINT` with `/run-runner.sh`:
 
 ```
-docker run -d --name ghc_runner --rm --entrypoint "/run-runner.sh" -v ghc_sqlitedb:/GeoHealthCheck/DB geopython/geohealthcheck:latest
+docker run -d --name ghc_runner --rm --entrypoint "/app/docker/scripts/run-runner.sh" -v ghc_sqlitedb:/app/instance/DB geopython/geohealthcheck:latest
+```
+
+You can also run the GHC standard tests by overriding the default `ENTRYPOINT` with `/run-tests.sh`:
+
+```
+docker run --name ghc_tests --rm --entrypoint "docker/scripts/run-tests.sh" -v ghc_sqlitedb:/app/instance/DB -e GHC_LOG_LEVEL=10 geopython/geohealthcheck:latest
 ```
 
 But the most optimal way to run GHC with scheduled jobs and optionally Postgres as backend DB,
@@ -177,7 +182,7 @@ Here we use `.env` files.
       - /run-runner.sh
 
     volumes:
-      - ghc_sqlitedb:/GeoHealthCheck/DB
+      - ghc_sqlitedb:/app/instance/DB
 
 ```
 
@@ -206,7 +211,7 @@ version:
       - /run-runner.sh
 
   postgis_ghc:
-    image: mdillon/postgis:9.6-alpine
+    image: mdillon/postgis:14-3.5-alpine
 
     container_name: postgis_ghc
 
@@ -223,7 +228,8 @@ Here [ghc-postgis.env](compose/ghc-postgis.env) adds extra Postgres-related conf
 ## Other tasks
 
 You can always `bash` into the GHC Container to run maintenance tasks.
-The GHC installation is at `/GeoHealthCheck` within the Docker Container.
+The GHC installation is at `/app` within the Docker Container. The container runs under
+user `ghc`. The home dir is `/home/ghc`.
 
 ```
 
@@ -232,7 +238,7 @@ docker exec -it docker_geohealthcheck_1 bash
 
 # setup Python venv
 source /venv/bin/activate .
-cd /GeoHealthCheck/
+cd /app/
  
 # next can use Invoke commands e.g. DB upgrade
 invoke upgrade

docker/compose/docker-compose.postgis.yml

@@ -31,7 +31,7 @@ services:
       # - configure in ghc.env
       # - mount these as docker volume on host
       # See https://docs.docker.com/compose/compose-file/#volumes
-      # - ./../GeoHealthCheck/plugins:/plugins:ro
+      # - ./../app/plugins:/plugins:ro
 
   ghc_runner:
     image: geopython/geohealthcheck:latest
@@ -51,15 +51,15 @@ services:
       - postgis_ghc
 
     entrypoint:
-      - /run-runner.sh
+      - /app/docker/scripts/run-runner.sh
 
     # volumes:
       # Optional Plugins, using Path on the host, relative to this Compose file
       # To activate 2 steps:
       # - configure in ghc.env
       # - mount these as docker volume on host
       # See https://docs.docker.com/compose/compose-file/#volumes
-      # - ./../GeoHealthCheck/plugins:/plugins:ro
+      # - ./../app/plugins:/plugins:ro
 
   postgis_ghc:
     image: postgis/postgis:14-3.5-alpine

docker/compose/docker-compose.yml

@@ -20,13 +20,13 @@ services:
       - ghc.env
 
     volumes:
-      - ghc_sqlitedb:/GeoHealthCheck/DB
+      - ghc_sqlitedb:/app/instance/DB
       # Optional Plugins, using Path on the host, relative to this Compose file
       # To activate: 2 steps for runner and GHC webapp:
       # - configure in ghc.env
       # - mount these as docker volume on host
       # See https://docs.docker.com/compose/compose-file/#volumes
-      # - ./../GeoHealthCheck/plugins:/plugins:ro
+      # - ./../app/plugins:/plugins:ro
 
   ghc_runner:
     image: geopython/geohealthcheck:latest
@@ -39,16 +39,16 @@ services:
       - ghc.env
 
     entrypoint:
-      - /run-runner.sh
+      - /app/docker/scripts/run-runner.sh
 
     volumes:
-      - ghc_sqlitedb:/GeoHealthCheck/DB
+      - ghc_sqlitedb:/app/instance/DB
       # Optional Plugins, using Path on the host, relative to this Compose file
       # To activate 2 steps:
       # - configure in ghc.env
       # - mount these as docker volume on host
       # See https://docs.docker.com/compose/compose-file/#volumes
-      # - ./../GeoHealthCheck/plugins:/plugins:ro
+      # - ./../app/plugins:/plugins:ro
 
 # docker-compose v2+ needs separate volumes section
 volumes:

docker/compose/ghc.env

@@ -1,4 +1,4 @@
-SQLALCHEMY_DATABASE_URI=sqlite:////GeoHealthCheck/DB/data.db
+SQLALCHEMY_DATABASE_URI=sqlite:////app/instance/DB/data.db
 
 # Core variables settings, change at will.
 GHC_RUNNER_IN_WEBAPP=False