39 lines
1.1 KiB
Markdown
39 lines
1.1 KiB
Markdown
# 0. Introduction
|
|
|
|
- Did it on a macbook air as I am away from my Linux workstation at home
|
|
- I will use some of my selfhosted services in examples, e.g. `registry.bouvais.lu` for docker registry and `git.bouvais.lu` for gitea.
|
|
|
|
# 1. Create env
|
|
|
|
First let's install everything that I will use using `brew`.
|
|
|
|
```
|
|
brew install docker
|
|
```
|
|
|
|
# 2. Images
|
|
|
|
```
|
|
FROM python:3.12-slim-bookworm AS base
|
|
|
|
LABEL org.opencontainers.image.title="tenant-base" \
|
|
org.opencontainers.image.description="Hardened base image for tenant workspaces" \
|
|
org.opencontainers.image.source="https://github.com/yourorg/yourrepo"
|
|
|
|
# System deps only — keep this layer stable so it's rarely rebuilt
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
tini \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user, fixed UID/GID for predictable K8s securityContext
|
|
RUN groupadd --gid 1000 appuser \
|
|
&& useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
|
|
|
|
WORKDIR /home/appuser
|
|
USER appuser
|
|
|
|
ENTRYPOINT ["tini", "--"]
|
|
```
|