cloud-native-api/Dockerfile at main · severlansdev/cloud-native-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# ============================================================
# Multi-Stage Dockerfile - Production-Ready & Secure
# ============================================================
# Stage 1: Build dependencies in a full Python image
# Stage 2: Copy only what's needed into a minimal runtime image
#
# Result: ~80MB image vs ~900MB with a standard Ubuntu base
# Security: No shell, no package manager, minimal attack surface
# ============================================================

# ---- Stage 1: Builder ----
FROM python:3.11-slim AS builder

WORKDIR /build

# Install dependencies into a clean prefix (no system pollution)
COPY requirements.txt .
RUN pip install \
    --no-cache-dir \
    --prefix=/install \
    --no-warn-script-location \
    -r requirements.txt

# Copy application source
COPY app/ ./app/

# ---- Stage 2: Runtime (Distroless) ----
FROM gcr.io/distroless/python3-debian12:nonroot

# Labels for container metadata (OCI standard)
LABEL org.opencontainers.image.title="cloud-native-api" \
      org.opencontainers.image.description="Production-ready FastAPI with observability" \
      org.opencontainers.image.authors="Brayan PD <brayanpd23@gmail.com>" \
      org.opencontainers.image.source="https://github.com/severlansdev/cloud-native-api"

WORKDIR /app

# Set PYTHONPATH so Distroless can find installed packages
# (Distroless sys.path doesn't include site-packages by default)
ENV PYTHONPATH="/usr/lib/python3.11/site-packages"

# Copy installed Python packages from builder (3.11 matches Distroless runtime)
COPY --from=builder /install/lib/python3.11/site-packages /usr/lib/python3.11/site-packages
# Copy application code
COPY --from=builder /build/app ./app

# Expose the application port
EXPOSE 8000

# Health check for Docker / ECS
# Note: Distroless has no curl/wget, so we use Python's urllib
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD ["python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]

# Run as non-root user (distroless:nonroot runs as UID 65534)
# Using uvicorn directly via Python module
ENTRYPOINT ["python3", "-m", "uvicorn", "app.main:app", \
            "--host", "0.0.0.0", \
            "--port", "8000", \
            "--workers", "2", \
            "--log-level", "info", \
            "--proxy-headers", \
            "--forwarded-allow-ips", "*"]