docker reduction

Author: jaytaph

.dockerignore

@@ -1,3 +1,9 @@
 app.conf
 .git
 .github
+tests/
+docs/
+coverage.xml
+sonar-project.properties
+LICENSES/
+app.test.conf

.github/workflows/ci.yaml

@@ -210,11 +210,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Create version.json
+      - name: Set release version
         run: |
           RELEASE_VERSION="${GITHUB_REF#refs/*/}"
           echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
-          echo "{ \"version\": \"${RELEASE_VERSION}\", \"git_ref\": \"$GITHUB_SHA\"}" > version.json
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
@@ -238,6 +237,8 @@ jobs:
             NEW_UID=${{ env.NEW_UID }}
             NEW_GID=${{ env.NEW_GID }}
             standalone=true
+            RELEASE_VERSION=${{ env.RELEASE_VERSION }}
+            GIT_SHA=${{ github.sha }}
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.35.0
@@ -268,18 +269,6 @@ jobs:
           skip-setup-trivy: true
 
       - name: Push Docker image
-        uses: docker/build-push-action@v7
         if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
-        env:
-          NEW_UID: 1000
-          NEW_GID: 1000
-        with:
-          context: .
-          file: docker/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            NEW_UID=${{ env.NEW_UID }}
-            NEW_GID=${{ env.NEW_GID }}
-            standalone=true
+        run: |
+          echo "${{ steps.meta.outputs.tags }}" | xargs -I{} docker push {}

.github/workflows/release-package-venv.yaml

@@ -10,7 +10,7 @@ jobs:
     strategy:
       matrix:
         python_version: ['3.11', '3.14']
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/release-package.yaml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Set env
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV &&

Makefile

@@ -2,14 +2,22 @@ NEW_UID = 1000
 NEW_GID = 1000
 
 ifdef DOCKER
-  RUN_PREFIX := docker compose run --rm app
+	RUN_PREFIX := docker compose run --rm app
+else ifdef POETRY
+	RUN_PREFIX := poetry run
 else
-  RUN_PREFIX :=
+	RUN_PREFIX :=
 endif
 
 .SILENT: help
 all: help
 
+container-build: ## Build the container
+	docker compose build --build-arg="NEW_UID=${NEW_UID}" --build-arg="NEW_GID=${NEW_GID}"
+
+container-build-sa: ## Build the container for standalone mode
+	docker compose build --build-arg="NEW_UID=${NEW_UID}" --build-arg="NEW_GID=${NEW_GID}" --build-arg="standalone=true"
+
 up: ## Start the container
 	docker compose up
 

docker/Dockerfile

@@ -1,4 +1,5 @@
 # syntax=docker/dockerfile:1
+# syntax directive is used to enable Docker BuildKit
 
 ARG PYTHON_VERSION=3.14
 
@@ -7,8 +8,8 @@ FROM python:${PYTHON_VERSION}-slim AS base
 ARG PROJECT_DIR="/src"
 ARG APP_USER="app"
 ARG APP_GROUP="app"
-ARG NEW_UID=1000
-ARG NEW_GID=1000
+ARG NEW_UID
+ARG NEW_GID
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -23,6 +24,17 @@ RUN groupadd --system ${APP_GROUP} --gid=${NEW_GID} && \
         --gid ${NEW_GID} \
         ${APP_USER}
 
+# Runtime-only system dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        openssl \
+        libssl3 \
+        libsodium23 \
+        postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR ${PROJECT_DIR}
+
 # Builder stage for compilation and dependencies
 FROM base AS builder
 
@@ -31,7 +43,6 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     apt-get update && \
     apt-get install -y --no-install-recommends \
         git \
-        curl \
         ca-certificates \
         pkg-config \
         libssl-dev \
@@ -51,48 +62,40 @@ RUN git clone --depth 1 --branch v0.9.3 https://github.com/stef/liboprf.git . &&
     cd src && \
     make
 
-# Install Python dependencies
+# Install Python dependencies into a virtualenv
 WORKDIR ${PROJECT_DIR}
 COPY ./pyproject.toml ./poetry.lock ./
 
-ENV POETRY_CACHE_DIR=/root/.cache/poetry \
-    POETRY_VIRTUALENVS_CREATE=false
+ENV POETRY_CACHE_DIR=/tmp/poetry-cache \
+    POETRY_VIRTUALENVS_CREATE=true \
+    POETRY_VIRTUALENVS_IN_PROJECT=true
 
-RUN --mount=type=cache,target=/root/.cache/poetry \
+RUN --mount=type=cache,target=${POETRY_CACHE_DIR} \
     poetry install --no-root --no-interaction --only main
 
 # Final stage
 FROM base AS final
 
-ARG PYTHON_VERSION
-
-# Install only runtime dependencies
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-        openssl \
-        curl \
-        libssl3 \
-        libsodium23 \
-        postgresql-client \
-        gettext-base \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR ${PROJECT_DIR}
-
 # Copy compiled libraries
-COPY --from=builder --chown=${APP_USER}:${APP_GROUP} /liboprf/src/noise_xk/lib*.so /usr/local/lib/
-COPY --from=builder --chown=${APP_USER}:${APP_GROUP} /liboprf/src/lib*.so /usr/local/lib/
+COPY --from=builder /liboprf/src/noise_xk/lib*.so /usr/local/lib/
+COPY --from=builder /liboprf/src/lib*.so /usr/local/lib/
 RUN ldconfig
 
-# Copy Python packages
-COPY --chown=${APP_USER}:${APP_GROUP} --from=builder /usr/local/lib/python${PYTHON_VERSION}/site-packages /usr/local/lib/python${PYTHON_VERSION}/site-packages
+# Copy only the virtualenv — no pip, no poetry, no build tools
+COPY --from=builder --chown=${APP_USER}:${APP_GROUP} /src/.venv /src/.venv
 
-# Copy application
-COPY --chown=${APP_USER}:${APP_GROUP} . ${PROJECT_DIR}
+# Copy only what the app needs at runtime (no tests, docs, CI artifacts, etc.)
+COPY --chown=${APP_USER}:${APP_GROUP} app/ /src/app/
+COPY --chown=${APP_USER}:${APP_GROUP} sql/ /src/sql/
+COPY --chown=${APP_USER}:${APP_GROUP} tools/ /src/tools/
+COPY --chown=${APP_USER}:${APP_GROUP} app.conf.example /src/
+
+# version.json is generated from build args so CI workspace artifacts never leak in
+ARG RELEASE_VERSION=dev
+ARG GIT_SHA=unknown
+RUN echo "{\"version\": \"${RELEASE_VERSION}\", \"git_ref\": \"${GIT_SHA}\"}" > /src/version.json \
+    && chown ${APP_USER}:${APP_GROUP} /src/version.json
 
-# Copy and set permissions on entrypoint scripts
 COPY --chmod=755 ./docker/init-standalone.sh /usr/local/bin/
 COPY --chmod=755 ./docker/init.sh /usr/local/bin/
 
@@ -106,6 +109,11 @@ RUN if [ "$standalone" = "true" ] ; then \
 
 USER ${APP_USER}
 
-ENV PYTHONPATH=${PROJECT_DIR}
+EXPOSE 6502
+WORKDIR ${PROJECT_DIR}
+
+ENV PYTHONPATH=${PROJECT_DIR} \
+    VIRTUAL_ENV=/src/.venv \
+    PATH="/src/.venv/bin:$PATH"
 
 ENTRYPOINT ["/docker-entrypoint.sh"]

poetry.lock

@@ -15,7 +15,6 @@ python = "^3.11"
 uvicorn = "^0.40.0"
 fastapi = "^0.129"
 async-timeout = "5.0.1"
-mypy = "^1.19.1"
 pydantic-settings = "^2.13.0"
 inject = "^5.3.0"
 pycryptodome = "^3.23.0"
@@ -32,11 +31,12 @@ pyoprf = "^0.9.3"
 jwcrypto = "^1.5.6"
 sqlalchemy = "^2.0.46"
 psycopg = "^3.3.2"
-testcontainers = "^4.14.1"
 puzi = { git = "https://github.com/minvws/puzi-python" }
 pyjwt = "^2.11.0"
 
 [tool.poetry.group.dev.dependencies]
+mypy = "^1.19.1"
+testcontainers = "^4.14.1"
 pytest = "^9.0.2"
 pytest-cov = "^7.0.0"
 pytest-mock = "^3.15.1"