80 lines
3.4 KiB
Docker
80 lines
3.4 KiB
Docker
# #region docker.backend.Dockerfile [C:3] [TYPE Module] [SEMANTICS docker,backend,build]
|
||
# @BRIEF Backend Dockerfile — Python 3.13 slim + Playwright + entrypoint с установкой сертификатов.
|
||
# @LAYER Infrastructure
|
||
# @RELATION DEPENDS_ON -> [EXT:path:docker/backend.entrypoint.sh]
|
||
# @RELATION DEPENDS_ON -> [EXT:path:backend/requirements-backend.txt]
|
||
# @PRE Docker builder context — корень проекта. backend/, docker/ доступны.
|
||
# @POST Образ с backend API, Playwright, entrypoint для bootstrap admin.
|
||
|
||
FROM python:3.13-slim
|
||
|
||
ENV PYTHONDONTWRITEBYTECODE=1
|
||
ENV PYTHONUNBUFFERED=1
|
||
ENV BACKEND_PORT=8000
|
||
|
||
WORKDIR /app
|
||
|
||
# Системные зависимости
|
||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
ca-certificates \
|
||
curl \
|
||
git \
|
||
libnss3-tools \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# Python зависимости — backend runtime
|
||
COPY backend/requirements-backend.txt /app/backend/requirements-backend.txt
|
||
COPY backend/constraints-release.txt /app/backend/constraints-release.txt
|
||
RUN --mount=type=cache,target=/root/.cache/pip \
|
||
pip install -r /app/backend/requirements-backend.txt -c /app/backend/constraints-release.txt
|
||
|
||
# Browser binaries are required only by screenshot-capable deployments. API-only E2E
|
||
# stacks can opt out through INSTALL_PLAYWRIGHT_BROWSERS=0 to reduce image build pressure.
|
||
ARG INSTALL_PLAYWRIGHT_BROWSERS=1
|
||
RUN if [ "$INSTALL_PLAYWRIGHT_BROWSERS" = "1" ]; then python -m playwright install --with-deps chromium; fi
|
||
|
||
# Исходный код
|
||
COPY backend/ /app/backend/
|
||
ARG SOURCE_REPOSITORY_IDENTITY_JSON
|
||
ENV SOURCE_REPOSITORY_IDENTITY_FILE=/app/source-repository-identity.json
|
||
# Explicit build metadata is optional for API startup; absence makes publication unavailable.
|
||
# No shell interpolation of JSON and no runtime Git/source guess.
|
||
RUN cd /app/backend && python - <<'PY'
|
||
import os
|
||
from pathlib import Path
|
||
from src.core.source_repository_identity import SourceRepositoryRefusal, decode_source_identity
|
||
|
||
raw = os.environ.get("SOURCE_REPOSITORY_IDENTITY_JSON")
|
||
if raw:
|
||
try:
|
||
decode_source_identity(raw)
|
||
except SourceRepositoryRefusal:
|
||
raw = None
|
||
if raw:
|
||
path = Path("/app/source-repository-identity.json")
|
||
path.write_text(raw, encoding="utf-8")
|
||
path.chmod(0o444)
|
||
PY
|
||
# Runtime JSON schemas used by catalog publication and capture profiles.
|
||
# Package the complete contract directories so baseline admission and evaluation
|
||
# use the same canonical schemas as the source checkout.
|
||
COPY specs/037-superset-baseline-engine/contracts/ /app/specs/037-superset-baseline-engine/contracts/
|
||
COPY specs/038-dashboard-scenario-model/contracts/ /app/specs/038-dashboard-scenario-model/contracts/
|
||
RUN test -s /app/specs/037-superset-baseline-engine/contracts/baseline-catalog.schema.json \
|
||
&& test -s /app/specs/037-superset-baseline-engine/contracts/baseline-pin.schema.json \
|
||
&& test -s /app/specs/037-superset-baseline-engine/contracts/reference-url.schema.json \
|
||
&& test -s /app/specs/038-dashboard-scenario-model/contracts/capture-profile.schema.json
|
||
|
||
# Копируем shared certs.sh и entrypoint
|
||
COPY docker/certs.sh /app/certs.sh
|
||
COPY docker/backend.entrypoint.sh /app/entrypoint.sh
|
||
RUN chmod +x /app/entrypoint.sh
|
||
|
||
WORKDIR /app/backend
|
||
|
||
EXPOSE 8000
|
||
|
||
ENTRYPOINT ["/app/entrypoint.sh"]
|
||
CMD ["python", "-m", "uvicorn", "src.app:app", "--host", "0.0.0.0", "--port", "8000"]
|
||
# #endregion docker.backend.Dockerfile
|