first commit

README.md

@@ -0,0 +1,38 @@
+# 0. Introduction
+
+- Did it on a macbook air as I am away from my Linux workstation at home
+- I will use some of my selfhosted services in examples, e.g. `registry.bouvais.lu` for docker registry and `git.bouvais.lu` for gitea.
+
+# 1. Create env
+
+First let's install everything that I will use using `brew`.
+
+```
+brew install docker
+```
+
+# 2. Images
+
+```
+FROM python:3.12-slim-bookworm AS base
+
+LABEL org.opencontainers.image.title="tenant-base" \
+      org.opencontainers.image.description="Hardened base image for tenant workspaces" \
+      org.opencontainers.image.source="https://github.com/yourorg/yourrepo"
+
+# System deps only — keep this layer stable so it's rarely rebuilt
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        tini \
+    && rm -rf /var/lib/apt/lists/*
+
+# Non-root user, fixed UID/GID for predictable K8s securityContext
+RUN groupadd --gid 1000 appuser \
+    && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
+
+WORKDIR /home/appuser
+USER appuser
+
+ENTRYPOINT ["tini", "--"]
+```