79 lines
4 KiB
Docker
79 lines
4 KiB
Docker
FROM ghcr.io/astral-sh/uv:0.9.30@sha256:538e0b39736e7feae937a65983e49d2ab75e1559d35041f9878b7b7e51de91e4 AS uv
|
|
|
|
FROM docker.io/library/python:3.11.9-slim-bookworm@sha256:8fb099199b9f2d70342674bd9dbccd3ed03a258f26bbd1d556822c6dfc60c317 AS python-build
|
|
|
|
COPY --from=uv /uv /usr/local/bin/uv
|
|
COPY artifact/hermes-agent /opt/livingip/leoclean-nosend/artifact/hermes-agent
|
|
|
|
RUN /usr/local/bin/uv venv \
|
|
--python /usr/local/bin/python3.11 \
|
|
--no-project \
|
|
/opt/livingip/leoclean-nosend/venv \
|
|
&& VIRTUAL_ENV=/opt/livingip/leoclean-nosend/venv /usr/local/bin/uv sync \
|
|
--directory /opt/livingip/leoclean-nosend/artifact/hermes-agent \
|
|
--active \
|
|
--frozen \
|
|
--no-dev \
|
|
--extra cron \
|
|
--no-editable \
|
|
&& /usr/local/bin/uv pip check --python /opt/livingip/leoclean-nosend/venv/bin/python
|
|
|
|
FROM docker.io/library/postgres:16.14-bookworm@sha256:92620daddcd947f8d5ab5ba66e848702fe443d87fed30c4cea8e389fd78dfc55
|
|
|
|
ARG TELEO_REVISION
|
|
ARG ARTIFACT_SHA256
|
|
ARG IDENTITY_SHA256
|
|
ARG INPUT_SHA256
|
|
|
|
LABEL org.opencontainers.image.source="https://github.com/living-ip/teleo-infrastructure" \
|
|
org.opencontainers.image.revision="${TELEO_REVISION}" \
|
|
livingip.artifact.sha256="${ARTIFACT_SHA256}" \
|
|
livingip.identity.sha256="${IDENTITY_SHA256}" \
|
|
livingip.input.sha256="${INPUT_SHA256}" \
|
|
livingip.runtime="leoclean-nosend" \
|
|
livingip.target="gcp-staging"
|
|
|
|
COPY --from=python-build /usr/local /usr/local
|
|
COPY --from=python-build /opt/livingip/leoclean-nosend/venv /opt/livingip/leoclean-nosend/venv
|
|
COPY artifact /opt/livingip/leoclean-nosend/artifact
|
|
COPY identity /opt/livingip/leoclean-nosend/identity
|
|
COPY identity-sources /opt/livingip/leoclean-nosend/identity-sources
|
|
COPY scripts /opt/livingip/leoclean-nosend/scripts
|
|
COPY entrypoint.py /opt/livingip/leoclean-nosend/entrypoint.py
|
|
COPY package_contract.py /opt/livingip/leoclean-nosend/package_contract.py
|
|
COPY artifact-receipt.json /opt/livingip/leoclean-nosend/metadata/artifact-receipt.json
|
|
COPY image-input.json /opt/livingip/leoclean-nosend/metadata/image-input.json
|
|
COPY Dockerfile /opt/livingip/leoclean-nosend/metadata/Dockerfile
|
|
COPY cloudsql-server-ca.pem /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem
|
|
|
|
RUN ln -s /usr/local/bin/python3.11 /usr/bin/python3 \
|
|
&& mkdir -p /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
|
|
&& chmod 0755 /usr/local/libexec/livingip/leoclean-kb \
|
|
&& chmod 0555 /usr/local/libexec/livingip/leoclean-kb/gcloud-config \
|
|
&& chmod 0444 /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem \
|
|
&& chmod 0555 /opt/livingip/leoclean-nosend/entrypoint.py \
|
|
&& chmod 0444 /opt/livingip/leoclean-nosend/package_contract.py \
|
|
&& find /opt/livingip/leoclean-nosend/identity -type f -exec chmod 0444 {} + \
|
|
&& case "$TELEO_REVISION" in (*[!0-9a-f]*|'') exit 65;; esac \
|
|
&& test "${#TELEO_REVISION}" -eq 40 \
|
|
&& for digest in "$ARTIFACT_SHA256" "$IDENTITY_SHA256" "$INPUT_SHA256"; do \
|
|
case "$digest" in (*[!0-9a-f]*|'') exit 65;; esac; \
|
|
test "${#digest}" -eq 64; \
|
|
done \
|
|
&& test "$(/usr/local/bin/python3.11 -c 'import platform; print(platform.python_version())')" = "3.11.9" \
|
|
&& /usr/bin/psql --version | grep -Eq '^psql \(PostgreSQL\) 16[.]14([[:space:]]|$)' \
|
|
&& test "$(sha256sum /usr/local/libexec/livingip/leoclean-kb/cloudsql-server-ca.pem | cut -d ' ' -f 1)" = "80701e768f0e1f6b9d621aa0b53f6e851daaa276c6d9a8e51a300fbc015539cb" \
|
|
&& /opt/livingip/leoclean-nosend/venv/bin/python /opt/livingip/leoclean-nosend/entrypoint.py \
|
|
verify-build "$TELEO_REVISION" "$ARTIFACT_SHA256" "$IDENTITY_SHA256" "$INPUT_SHA256"
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONNOUSERSITE=1 \
|
|
PYTHONSAFEPATH=1
|
|
|
|
STOPSIGNAL SIGTERM
|
|
|
|
HEALTHCHECK --interval=15s --timeout=10s --start-period=30s --retries=4 \
|
|
CMD ["/opt/livingip/leoclean-nosend/venv/bin/python", "/opt/livingip/leoclean-nosend/entrypoint.py", "health"]
|
|
|
|
ENTRYPOINT ["/opt/livingip/leoclean-nosend/venv/bin/python", "/opt/livingip/leoclean-nosend/entrypoint.py"]
|
|
CMD ["service"]
|