claude-bot
6ddff5583d
Round-3 review follow-up on c53d625 (P1/P2):
- P1: --build-staging now runs staging_check via parametrized
STAGING_CONTAINER / STAGING_CHECK_PATH / STAGING_CHECK_MODE (default
orchestrator-staging / bind-mount path / stub) instead of hardcoding
$TARGET_SERVICE + the script path. docker exec runs INSIDE the staging
container (ORCH-048 canonical: B6 registry isolation), after health,
before exit 0. Fail-closed: any non-zero -> exit 1. STAGING only (8501).
- P2a: rebuild_staging_image now passes the STAGING target EXPLICITLY
(TARGET_SERVICE/TARGET_PORT/COMPOSE_PROFILE/STAGING_CONTAINER) so the
self-rebuild can never drift onto prod 8500 if hook defaults change (AC-9).
- P2b: TC-09 caller<->hook contract tests assert the ssh command carries
GIT_SHA + BUILD_CONTEXT + the staging target and never the prod 8500 one;
no-ssh-host fails closed.
- P3: consolidated the three duplicate README footers into one.
- Docs (golden source): DEPLOY_HOOK.md step 4 + env rows, README footer,
CHANGELOG, Dockerfile ARG GIT_SHA="" comment, .env.example freshness block.
Validates exactly the artefact later BUILD-ONCE retagged to prod (AC-4,
ADR-001 step 3). 632 tests pass, ruff clean, bash -n OK.
Refs: ORCH-058
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
26 lines
1.4 KiB
Docker
26 lines
1.4 KiB
Docker
FROM python:3.12-slim
|
|
# ORCH-058 (Strategy B): stamp the image with the git commit it was built from so
|
|
# the deploy hook can fail-close if a stale staging image would be promoted to prod
|
|
# (INV-FRESH). Passed at build time via `--build-arg GIT_SHA=<sha>` (the staging
|
|
# rebuild in check_staging_image_fresh / the --build-staging hook mode supplies it).
|
|
# Without the build-arg the label is empty -> the hook treats it as a mismatch
|
|
# (fail-closed). The OCI-standard key is read by `docker image inspect`.
|
|
ARG GIT_SHA=""
|
|
LABEL org.opencontainers.image.revision=$GIT_SHA
|
|
WORKDIR /app
|
|
RUN apt-get update -qq && apt-get install -y -qq openssh-client git && rm -rf /var/lib/apt/lists/*
|
|
# git operations run as root over bind-mounted /repos (may be owned by host uid) -> trust it.
|
|
RUN git config --system --add safe.directory '*'
|
|
# ORCH-58: compose runs the container as uid:gid 1000:1000 (ORCH-40), but the base
|
|
# image has no passwd entry for uid 1000 -> ssh/whoami fail with
|
|
# "No user exists for uid 1000" (rc=255), breaking the detached self-deploy ssh
|
|
# launch (ORCH-36 Phase B). Create a real user 1000 with a home dir so getpwuid()
|
|
# resolves and ssh can start.
|
|
RUN groupadd -g 1000 app && useradd -u 1000 -g 1000 -m -d /home/slin -s /bin/bash slin
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
COPY src/ ./src/
|
|
COPY data/ ./data/
|
|
ENV PYTHONPATH=/app
|
|
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8500"]
|