This commit is contained in:
@@ -4,14 +4,12 @@ LABEL org.opencontainers.image.title="tenant-base" \
|
||||
org.opencontainers.image.description="Hardened base image for tenant workspaces" \
|
||||
org.opencontainers.image.source="https://git.bouvais.lu/adrien/"
|
||||
|
||||
# System deps only — keep this layer stable so it's rarely rebuilt
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
ca-certificates \
|
||||
curl \
|
||||
tini \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Non-root user, fixed UID/GID for predictable K8s securityContext
|
||||
RUN groupadd --gid 1000 appuser \
|
||||
&& useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
|
||||
|
||||
|
||||
@@ -10,7 +10,6 @@ COPY --chown=appuser:appuser requirements.txt /tmp/requirements.txt
|
||||
RUN pip install --no-cache-dir -r /tmp/requirements.txt \
|
||||
&& rm /tmp/requirements.txt
|
||||
|
||||
# No secrets baked in — S3 creds come from a mounted K8s Secret / env at runtime
|
||||
USER appuser
|
||||
WORKDIR /home/appuser/work
|
||||
|
||||
|
||||
Reference in New Issue
Block a user