SEP-1014 Use Debian Python image instead of Alpine for SEP app/frontend (#701)

Currently, SEP app/frontend run on official Python Docker image based on
Alpine Linux. Alpine image is very small, which is good, but `musl` C
library forces Python library recompilation + potential runtime bugs.
Official Python/Node images also publish a Debian-based `-slim` version,
which is proven and mostly secure given how popular Debian is

Author: crimethinking

Containerfile.base

@@ -3,7 +3,7 @@
 ###########
 
 # Use an official Python runtime as a parent image
-FROM docker.io/library/python:3.11.14-alpine AS builder
+FROM docker.io/library/python:3.11.14-slim AS builder
 
 # Set work directory
 WORKDIR /usr/src/sep
@@ -14,7 +14,10 @@ ENV PYTHONUNBUFFERED=1
 ENV FASTAPI_ENV=production_docker
 
 # Install dependencies
-RUN apk update && apk add --no-cache g++ git
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends g++ git && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 # Export requirements
 RUN pip install --no-cache-dir wheel poetry==2.2.1 poetry-plugin-export

Dockerfile

@@ -13,7 +13,7 @@ ENV FASTAPI_ENV=production_docker
 # FRONTEND BUILDER #
 ####################
 
-FROM node:22-alpine AS frontend-builder
+FROM node:22-slim AS frontend-builder
 
 WORKDIR /app
 
@@ -28,14 +28,23 @@ RUN pnpm install --frozen-lockfile && pnpm build
 #########
 
 # Use an official Python runtime as a parent image
-FROM docker.io/library/python:3.11.14-alpine
+FROM docker.io/library/python:3.11.14-slim
 
 # Install dependencies
-RUN apk update && apk add --no-cache g++ pango fontconfig ttf-dejavu
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        g++ \
+        libpango-1.0-0 \
+        libpangoft2-1.0-0 \
+        fontconfig \
+        fonts-dejavu \
+        shared-mime-info && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 # Create the sep system user
-RUN addgroup --gid 1001 -S sep && \
-    adduser -G sep --shell /bin/false --disabled-password -h /home/sep --uid 1001 sep
+RUN groupadd --gid 1001 sep && \
+    useradd --gid sep --shell /usr/sbin/nologin --home-dir /home/sep --uid 1001 --create-home sep
 
 # Create the appropriate directories
 ENV HOME=/home/sep
@@ -44,7 +53,10 @@ RUN install -d -o 1001 -g 1001 -m 0750 $APP_HOME
 WORKDIR $APP_HOME
 
 # Install dependencies
-RUN apk update && apk add --no-cache netcat-openbsd
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends netcat-openbsd && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 COPY --from=builder /usr/src/sep/wheels /wheels
 COPY --from=builder /usr/src/sep/requirements.txt .
 RUN pip install --no-cache-dir wheel