mirror of
https://github.com/suitenumerique/meet.git
synced 2026-10-21 20:15:29 +00:00
briquet
458ac90617
Eight eMudhra intermediate CAs were compromised due to weak private keys, and the emSign Root CA - G3 / ECC Root CA - G3 roots have been removed from Mozilla and Chrome trust stores. Update uv, and bump certifi to 2026.10.19 and require ca-certificates >= 20261020-r0 in Alpine/Debian images Node.js has not shipped a fixed bundled root store yet.
77 lines
1.8 KiB
Docker
77 lines
1.8 KiB
Docker
FROM python:3.14.8-slim AS base
|
|
|
|
# Install system dependencies required by LiveKit, fetching packages over HTTPS only for Bureautix proxy
|
|
RUN sed -i "s|^URIs: http://|URIs: https://|" /etc/apt/sources.list.d/debian.sources \
|
|
&& apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
libglib2.0-0 \
|
|
libgobject-2.0-0 \
|
|
libpcre2-8-0 \
|
|
libssl3t64 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
|
|
# ---- Builder image ----
|
|
FROM base AS builder
|
|
|
|
ENV UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_PYTHON_DOWNLOADS=0
|
|
|
|
# Install uv
|
|
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
|
|
|
|
WORKDIR /app
|
|
|
|
# Install production dependencies without the project itself (cacheable layer)
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=uv.lock,target=uv.lock \
|
|
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
|
|
uv sync --locked --no-install-project --no-dev
|
|
|
|
# Install the project
|
|
COPY . /app
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --locked --no-dev
|
|
|
|
|
|
# ---- Development image ----
|
|
FROM base AS development
|
|
|
|
ENV UV_COMPILE_BYTECODE=1 \
|
|
UV_LINK_MODE=copy \
|
|
UV_PYTHON_DOWNLOADS=0
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /uvx /bin/
|
|
|
|
WORKDIR /app
|
|
|
|
COPY . /app
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --locked --all-extras
|
|
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
CMD ["python", "multi_user_transcriber.py", "dev"]
|
|
|
|
|
|
# ---- Production image ----
|
|
FROM base AS production
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy the pre-built virtualenv and application source
|
|
COPY --from=builder /app /app
|
|
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
# Remove pip to reduce attack surface in production
|
|
RUN pip uninstall -y pip
|
|
|
|
# Un-privileged user running the application
|
|
ARG DOCKER_USER
|
|
USER ${DOCKER_USER}
|
|
|
|
CMD ["python", "multi_user_transcriber.py", "start"]
|