bridge/Containerfile at main · allthingslinux/bridge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
# ============================================================================
# ATL Bridge — Discord–IRC–XMPP multi-presence bridge
# ============================================================================
# Stage 1: common     — base image + non-root user + shared env
# Stage 2: build      — install deps with uv, bake VERSION
# Stage 3: production — minimal runtime image
# ============================================================================

# ============================================================================
# STAGE 1: Common
# ============================================================================
FROM python:3.12-slim AS common

LABEL org.opencontainers.image.source="https://github.com/allthingslinux/bridge" \
    org.opencontainers.image.description="ATL Bridge - Discord–IRC–XMPP multi-presence bridge" \
    org.opencontainers.image.licenses="MIT" \
    org.opencontainers.image.authors="All Things Linux" \
    org.opencontainers.image.vendor="All Things Linux" \
    org.opencontainers.image.title="ATL Bridge" \
    org.opencontainers.image.documentation="https://github.com/allthingslinux/bridge/blob/main/README.md"

RUN groupadd --system --gid 1001 nonroot && \
    useradd --create-home --system --uid 1001 --gid nonroot nonroot

ENV DEBIAN_FRONTEND=noninteractive \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

# ============================================================================
# STAGE 2: Build
# ============================================================================
FROM common AS build

WORKDIR /app

COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

COPY pyproject.toml uv.lock README.md ./
COPY src ./src

ARG VERSION=""
ARG GIT_SHA=""
ARG BUILD_DATE=""

RUN set -eux; \
    if [ -n "$VERSION" ]; then \
    echo "$VERSION" > /app/VERSION; \
    else \
    echo "dev" > /app/VERSION; \
    fi

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --locked --no-dev

# ============================================================================
# STAGE 3: Production
# ============================================================================
FROM common AS production

WORKDIR /app

ENV VIRTUAL_ENV=/app/.venv \
    PATH="/app/.venv/bin:$PATH" \
    PYTHONPATH="/app/src" \
    PYTHONOPTIMIZE=1

COPY --from=build --chown=nonroot:nonroot /app/.venv /app/.venv
COPY --from=build --chown=nonroot:nonroot /app/src /app/src
COPY --from=build --chown=nonroot:nonroot /app/pyproject.toml /app/pyproject.toml
COPY --from=build --chown=nonroot:nonroot /app/VERSION /app/VERSION

# /app/config.yaml is bind-mounted at runtime; /data for optional persistence
RUN mkdir -p /data && chown nonroot:nonroot /data

USER nonroot

HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
    CMD python -c "import bridge; print('ok')" || exit 1

CMD ["bridge", "--config", "/app/config.yaml"]