claude-bot
b9bcdc1545
The ORCH-058 staging rebuild (check_staging_image_fresh) builds the image with
the task git-worktree as the docker build context. A fresh worktree holds only
tracked files, but the Dockerfile did `COPY data/ ./data/` — and `data/` (the
SQLite dir) is gitignored, so it is absent from that context: `docker build`
failed with exit 1 ("BUILD-STAGING: docker build failed - aborting"), bouncing
the task off deploy-staging back to development in a loop.
The COPY was dead weight regardless: `data/` is always supplied at runtime as a
bind-mount volume (./data:/app/data, see docker-compose.yml) which shadows
anything baked into the image. Replace it with `RUN mkdir -p /app/data` so the
mountpoint exists without depending on the build context.
Regression guard: test_tc08b_dockerfile_does_not_copy_gitignored_data_dir
forbids COPY of any gitignored path (the worktree-context invariant).
Refs: ORCH-021
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
33 lines
2.0 KiB
Docker
33 lines
2.0 KiB
Docker
FROM python:3.12-slim
|
|
# ORCH-058 (Strategy B): stamp the image with the git commit it was built from so
|
|
# the deploy hook can fail-close if a stale staging image would be promoted to prod
|
|
# (INV-FRESH). Passed at build time via `--build-arg GIT_SHA=<sha>` (the staging
|
|
# rebuild in check_staging_image_fresh / the --build-staging hook mode supplies it).
|
|
# Without the build-arg the label is empty -> the hook treats it as a mismatch
|
|
# (fail-closed). The OCI-standard key is read by `docker image inspect`.
|
|
ARG GIT_SHA=""
|
|
LABEL org.opencontainers.image.revision=$GIT_SHA
|
|
WORKDIR /app
|
|
RUN apt-get update -qq && apt-get install -y -qq openssh-client git && rm -rf /var/lib/apt/lists/*
|
|
# git operations run as root over bind-mounted /repos (may be owned by host uid) -> trust it.
|
|
RUN git config --system --add safe.directory '*'
|
|
# ORCH-58: compose runs the container as uid:gid 1000:1000 (ORCH-40), but the base
|
|
# image has no passwd entry for uid 1000 -> ssh/whoami fail with
|
|
# "No user exists for uid 1000" (rc=255), breaking the detached self-deploy ssh
|
|
# launch (ORCH-36 Phase B). Create a real user 1000 with a home dir so getpwuid()
|
|
# resolves and ssh can start.
|
|
RUN groupadd -g 1000 app && useradd -u 1000 -g 1000 -m -d /home/slin -s /bin/bash slin
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
COPY src/ ./src/
|
|
# ORCH-021: do NOT `COPY data/ ./data/`. `data/` is gitignored (SQLite DB dir) and
|
|
# is provided at runtime as a bind-mount volume (`./data:/app/data`, see
|
|
# docker-compose.yml) which shadows anything baked into the image — so the COPY was
|
|
# dead weight. Worse, the ORCH-058 staging rebuild (`check_staging_image_fresh`)
|
|
# builds with the task *worktree* as the docker build context; a fresh worktree never
|
|
# contains the untracked `data/`, so `COPY data/` failed `docker build` with exit 1
|
|
# and bounced the task off `deploy-staging`. We just ensure the mountpoint exists.
|
|
RUN mkdir -p /app/data
|
|
ENV PYTHONPATH=/app
|
|
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8500"]
|