parsedmarc/Dockerfile-debian.locked at main · mkilijanek/parsedmarc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# syntax=docker/dockerfile:1

############################
# Builder (Debian slim)
############################
FROM python:3.14-slim@sha256:5e59aae31ff0e87511226be8e2b94d78c58f05216efda3b07dbbed938ec8583b AS builder

ARG VCS_REF=""
ARG BUILD_DATE=""
ARG SOURCE_DATE_EPOCH=""

ENV VENV_PATH=/opt/venv
ENV PIP_DISABLE_PIP_VERSION_CHECK=1
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

WORKDIR /src
COPY requirements.lock /src/requirements.lock

RUN python -m venv "${VENV_PATH}" \
 && "${VENV_PATH}/bin/pip" install --no-cache-dir --upgrade pip \
 && mkdir -p /wheels \
 && "${VENV_PATH}/bin/pip" download --dest /wheels --require-hashes -r /src/requirements.lock \
 && "${VENV_PATH}/bin/pip" install --no-cache-dir --no-index --find-links=/wheels --require-hashes -r /src/requirements.lock \
 && rm -rf /wheels

############################
# Runtime (distroless Debian)
############################
FROM gcr.io/distroless/python3-debian12:nonroot@sha256:3aa5d1eb6e9f83a4ed806174bb40296e04758ab95f53b61f976d3df2b57ca289

ARG VCS_REF=""
ARG BUILD_DATE=""
ARG SOURCE_DATE_EPOCH=""

LABEL org.opencontainers.image.source="https://github.com/mkilijanek/parsedmarc" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.title="parsedmarc-locked (distroless debian12)" \
      org.opencontainers.image.vendor="mkilijanek"

ENV VENV_PATH=/opt/venv
ENV PATH="${VENV_PATH}/bin:${PATH}"
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

COPY --from=builder ${VENV_PATH} ${VENV_PATH}

USER 65532:65532

ENTRYPOINT ["parsedmarc"]
CMD ["-h"]