Update Dockerfile

xirixiz · Jan 15, 2025 · 1786bab · 1786bab
1 parent 6bcf4ab
commit 1786bab
Showing 1 changed file with 81 additions and 41 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -1,35 +1,37 @@
+# syntax=docker/dockerfile:1.4
+
 #---------------------------------------------------------------------------------------------------------------------------
 # STAGING STEP
 #---------------------------------------------------------------------------------------------------------------------------
 FROM --platform=$BUILDPLATFORM python:3.11-alpine3.21 as staging
+
 WORKDIR /app
 
-ARG DSMR_VERSION
-ENV DSMR_VERSION=${DSMR_VERSION:-5.0.0}
+ARG DSMR_VERSION=5.0.0
 
-RUN apk add --no-cache curl \
-    && echo "**** Download DSMR ****" \
-    && curl -SskLf "https://github.com/dsmrreader/dsmr-reader/archive/refs/tags/v${DSMR_VERSION}.tar.gz" | tar xvzf - --strip-components=1 -C /app \
-    && curl -SskLf "https://raw.githubusercontent.com/dsmrreader/dsmr-reader/v${DSMR_VERSION}/dsmr_datalogger/scripts/dsmr_datalogger_api_client.py" -o /app/dsmr_datalogger_api_client.py
+# Download and extract DSMR in a single layer
+RUN --mount=type=cache,target=/var/cache/apk \
+    apk add --no-cache curl \
+    && curl -SskLf "https://github.com/dsmrreader/dsmr-reader/archive/refs/tags/v${DSMR_VERSION}.tar.gz" | \
+       tar xzf - --strip-components=1 -C /app \
+    && curl -SskLf "https://raw.githubusercontent.com/dsmrreader/dsmr-reader/v${DSMR_VERSION}/dsmr_datalogger/scripts/dsmr_datalogger_api_client.py" \
+       -o /app/dsmr_datalogger_api_client.py
 
 #---------------------------------------------------------------------------------------------------------------------------
 # BASE STEP
 #---------------------------------------------------------------------------------------------------------------------------
 FROM python:3.11-alpine3.21 as base
 
-# Build arguments
+# Build arguments and environment variables
 ARG DSMR_VERSION
-ENV DSMR_VERSION=${DSMR_VERSION}
-ENV LD_LIBRARY_PATH=/usr/lib:/usr/local/lib:$LD_LIBRARY_PATH
-
-# Algemene omgevingsvariabelen
-ENV PS1="$(whoami)@dsmr_reader_docker:$(pwd)\\$ " \
+ENV DSMR_VERSION=${DSMR_VERSION} \
+    LD_LIBRARY_PATH=/usr/lib:/usr/local/lib:$LD_LIBRARY_PATH \
+    PS1="$(whoami)@dsmr_reader_docker:$(pwd)\\$ " \
     TERM="xterm" \
     PIP_NO_CACHE_DIR=1 \
-    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
-
-# DSMR Reader-specifieke omgevingsvariabelen
-ENV DJANGO_SECRET_KEY=dsmrreader \
+    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
+    # DSMR Reader default configuration
+    DJANGO_SECRET_KEY=dsmrreader \
     DJANGO_DATABASE_ENGINE=django.db.backends.postgresql \
     DJANGO_DATABASE_NAME=dsmrreader \
     DJANGO_DATABASE_USER=dsmrreader \
@@ -49,40 +51,67 @@ ENV DJANGO_SECRET_KEY=dsmrreader \
     DSMRREADER_REMOTE_DATALOGGER_NETWORK_HOST=127.0.0.1 \
     DSMRREADER_REMOTE_DATALOGGER_NETWORK_PORT=23
 
-# Kopieer bestanden uit staging
+# Copy files from staging
 COPY --from=staging /app /app
 
-RUN apk add --no-cache \
-    bash curl coreutils ca-certificates shadow jq nginx \
-    openssl postgresql17-client tzdata \
-    s6-overlay netcat-openbsd dpkg  \
-    libffi jpeg libjpeg-turbo libpng zlib mariadb-connector-c-dev \ 
-    && echo "**** install build dependencies and pip packages ****" \
+# Install dependencies and setup environment in a single layer
+RUN --mount=type=cache,target=/var/cache/apk \
+    --mount=type=cache,target=/root/.cache/pip \
+    set -ex \
+    && apk add --no-cache \
+       bash \
+       ca-certificates \
+       coreutils \
+       curl \
+       dpkg \
+       jpeg \
+       libffi \
+       libjpeg-turbo \
+       libpng \
+       mariadb-connector-c-dev \
+       netcat-openbsd \
+       nginx \
+       openssl \
+       postgresql17-client \
+       s6-overlay \
+       shadow \
+       tzdata \
+       zlib \
+    # Install build dependencies and pip packages
     && apk add --no-cache --virtual .build-deps \
-        gcc python3-dev musl-dev postgresql17-dev build-base rust cargo \
-        libffi-dev jpeg-dev libjpeg-turbo-dev libpng-dev zlib-dev mariadb-dev \
-    && python3 -m pip install --no-cache-dir --upgrade pip \    
+       build-base \
+       cargo \
+       gcc \
+       jpeg-dev \
+       libffi-dev \
+       libjpeg-turbo-dev \
+       libpng-dev \
+       mariadb-dev \
+       musl-dev \
+       postgresql17-dev \
+       python3-dev \
+       rust \
+       zlib-dev \
+    # Setup pip and install requirements
+    && python3 -m pip install --no-cache-dir --upgrade pip \
     && python3 -m pip install --no-cache-dir -r /app/dsmrreader/provisioning/requirements/base.txt \
     && python3 -m pip install --no-cache-dir tzupdate mysqlclient \
-    && echo "**** cleanup ****" \
-    && apk del .build-deps \
-    && rm -rf /var/cache/apk/* /tmp/* /root/.cache
-
-# Setup nginx
-RUN mkdir -p /run/nginx /etc/nginx/http.d /var/www/dsmrreader/static \
+    # Setup nginx
+    && mkdir -p /run/nginx /etc/nginx/http.d /var/www/dsmrreader/static \
     && ln -sf /dev/stdout /var/log/nginx/access.log \
     && ln -sf /dev/stderr /var/log/nginx/error.log \
     && rm -f /etc/nginx/http.d/default.conf \
-    && cp /app/dsmrreader/provisioning/nginx/dsmr-webinterface /etc/nginx/http.d/dsmr-webinterface.conf
-
-# Create app user
-RUN groupmod -g 1000 users \
+    && cp /app/dsmrreader/provisioning/nginx/dsmr-webinterface /etc/nginx/http.d/dsmr-webinterface.conf \
+    # Create app user and set permissions
+    && groupmod -g 1000 users \
     && useradd -u 803 -U -d /config -s /bin/false app \
     && usermod -G users,dialout,audio app \
-    && mkdir -p /config /defaults
-
-# Copy settings template
-RUN cp /app/dsmrreader/provisioning/django/settings.py.template /app/dsmrreader/settings.py
+    && mkdir -p /config /defaults \
+    # Copy settings template
+    && cp /app/dsmrreader/provisioning/django/settings.py.template /app/dsmrreader/settings.py \
+    # Cleanup
+    && apk del .build-deps \
+    && rm -rf /var/cache/apk/* /tmp/* /root/.cache
 
 #---------------------------------------------------------------------------------------------------------------------------
 # FINAL STEP
@@ -91,7 +120,18 @@ FROM base as final
 
 COPY rootfs /
 
-HEALTHCHECK --interval=15s --timeout=3s --retries=10 CMD curl -Lsf http://127.0.0.1/about -o /dev/null || exit 1
+# Improved healthcheck with timeout and retry settings
+HEALTHCHECK --interval=15s --timeout=3s --retries=10 \
+    CMD curl -Lsf http://127.0.0.1/about -o /dev/null || exit 1
 
 WORKDIR /app
+
+# Set secure permissions for application directory
+RUN chown -R app:app /app /config /defaults \
+    && chmod -R 755 /app \
+    && find /app -type f -exec chmod 644 {} \;
+
+# Use non-root user by default
+USER app
+
 ENTRYPOINT ["/init"]