Switch Dockerfiles to Debian Bookworm

Signed-off-by: Taylor Smock <[email protected]>

Author: tsmock

.dockerignore

@@ -2,6 +2,7 @@
 *.yml
 **/*.pyc
 **/__pypackages__
+**/__pycache__
 **/node_modules
 **/npm-debug.log
 **/venv

Dockerfile

@@ -1,50 +1,50 @@
-ARG ALPINE_IMG_TAG=3.17
+ARG DEBIAN_IMG_TAG=slim-bookworm
 ARG PYTHON_IMG_TAG=3.10
 
-FROM docker.io/python:${PYTHON_IMG_TAG}-alpine${ALPINE_IMG_TAG} as base
+FROM docker.io/python:${PYTHON_IMG_TAG}-${DEBIAN_IMG_TAG} as base
 ARG APP_VERSION=0.1.0
-ARG DOCKERFILE_VERSION=0.4.0
+ARG DOCKERFILE_VERSION=0.5.0
 ARG ALPINE_IMG_TAG
 ARG PYTHON_IMG_TAG
 ARG [email protected]
 LABEL org.hotosm.tasks.app-version="${APP_VERSION}" \
-      org.hotosm.tasks.alpine-img-tag="${ALPINE_IMG_TAG}" \
+      org.hotosm.tasks.debian-img-tag="${DEBIAN_IMG_TAG}" \
       org.hotosm.tasks.python-img-tag="${PYTHON_IMG_TAG}" \
       org.hotosm.tasks.dockerfile-version="${DOCKERFILE_VERSION}" \
       org.hotosm.tasks.maintainer="${MAINTAINER}" \
       org.hotosm.tasks.api-port="5000"
 # Fix timezone (do not change - see issue #3638)
 ENV TZ UTC
+# Add non-root user, permissions, init log dir
+RUN useradd --uid 9000 --create-home --home /home/appuser --shell /bin/false appuser
+
 
 
 
 FROM base as extract-deps
+RUN pip install --no-cache-dir --upgrade pip
 WORKDIR /opt/python
 COPY pyproject.toml pdm.lock README.md /opt/python/
-RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir pdm==2.5.3
+RUN pip install --no-cache-dir pdm==2.7.4
 RUN pdm export --prod --without-hashes > requirements.txt
 
 
 
 FROM base as build
+RUN pip install --no-cache-dir --upgrade pip
 WORKDIR /opt/python
 # Setup backend build-time dependencies
-RUN apk update && \
-    apk add \
-        postgresql-dev \
-        gcc \
-        g++ \
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y \
+        postgresql-server-dev-15 \
         python3-dev \
-        musl-dev \
         libffi-dev \
-        geos-dev \
-        proj-util \
-        proj-dev \
-        make
+        libgeos-dev
 # Setup backend Python dependencies
-COPY --from=extract-deps \
+COPY --chown=appuser:appuser --from=extract-deps \
     /opt/python/requirements.txt /opt/python/
+USER appuser:appuser
 RUN pip install --user --no-warn-script-location \
     --no-cache-dir -r /opt/python/requirements.txt
 
@@ -61,27 +61,25 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
     REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
 # Setup backend runtime dependencies
-RUN apk update && \
-    apk add --no-cache \
-        postgresql-libs geos proj-util
-COPY --from=build \
-    /root/.local \
+RUN apt-get update && \
+    apt-get install --no-install-recommends -y \
+        postgresql-client libgeos3.11.1 proj-bin && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+COPY --chown=appuser:appuser --from=build \
+    /home/appuser/.local \
     /home/appuser/.local
+USER appuser:appuser
 COPY backend backend/
 COPY migrations migrations/
 COPY scripts/world scripts/world/
 COPY scripts/database scripts/database/
 COPY manage.py .
-# Add non-root user, permissions, init log dir
-RUN adduser -D -u 900 -h /home/appuser -s /bin/false appuser \
-    && chown -R appuser:appuser /usr/src /home/appuser
 
 
 
 FROM runtime as debug
-RUN pip install --no-warn-script-location \
+RUN pip install --user --no-warn-script-location \
     --no-cache-dir debugpy==1.6.7
-USER appuser
 CMD ["python", "-m", "debugpy", "--wait-for-client", "--listen", "0.0.0.0:5678", \
     "-m", "gunicorn", "-c", "python:backend.gunicorn", "manage:application", \
     "--reload", "--log-level", "error"]
@@ -90,7 +88,9 @@ CMD ["python", "-m", "debugpy", "--wait-for-client", "--listen", "0.0.0.0:5678",
 
 FROM runtime as prod
 # Pre-compile packages to .pyc (init speed gains)
+USER root
 RUN python -c "import compileall; compileall.compile_path(maxlevels=10, quiet=1)"
-USER appuser
+USER appuser:appuser
+RUN python -m compileall .
 CMD ["gunicorn", "-c", "python:backend.gunicorn", "manage:application", \
     "--workers", "1", "--log-level", "error"]

scripts/docker/Dockerfile.backend

@@ -1,50 +1,50 @@
-ARG ALPINE_IMG_TAG=3.17
+ARG DEBIAN_IMG_TAG=slim-bookworm
 ARG PYTHON_IMG_TAG=3.10
 
-FROM docker.io/python:${PYTHON_IMG_TAG}-alpine${ALPINE_IMG_TAG} as base
+FROM docker.io/python:${PYTHON_IMG_TAG}-${DEBIAN_IMG_TAG} as base
 ARG APP_VERSION=0.1.0
-ARG DOCKERFILE_VERSION=0.4.0
+ARG DOCKERFILE_VERSION=0.5.0
 ARG ALPINE_IMG_TAG
 ARG PYTHON_IMG_TAG
 ARG [email protected]
 LABEL org.hotosm.tasks.app-version="${APP_VERSION}" \
-      org.hotosm.tasks.alpine-img-tag="${ALPINE_IMG_TAG}" \
+      org.hotosm.tasks.debian-img-tag="${DEBIAN_IMG_TAG}" \
       org.hotosm.tasks.python-img-tag="${PYTHON_IMG_TAG}" \
       org.hotosm.tasks.dockerfile-version="${DOCKERFILE_VERSION}" \
       org.hotosm.tasks.maintainer="${MAINTAINER}" \
       org.hotosm.tasks.api-port="5000"
 # Fix timezone (do not change - see issue #3638)
 ENV TZ UTC
+# Add non-root user, permissions, init log dir
+RUN useradd --uid 9000 --create-home --home /home/appuser --shell /bin/false appuser
+
 
 
 
 FROM base as extract-deps
+RUN pip install --no-cache-dir --upgrade pip
 WORKDIR /opt/python
 COPY pyproject.toml pdm.lock README.md /opt/python/
-RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir pdm==2.5.3
+RUN pip install --no-cache-dir pdm==2.7.4
 RUN pdm export --prod --without-hashes > requirements.txt
 
 
 
 FROM base as build
+RUN pip install --no-cache-dir --upgrade pip
 WORKDIR /opt/python
 # Setup backend build-time dependencies
-RUN apk update && \
-    apk add \
-        postgresql-dev \
-        gcc \
-        g++ \
+RUN apt-get update
+RUN apt-get install -y build-essential
+RUN apt-get install -y \
+        postgresql-server-dev-15 \
         python3-dev \
-        musl-dev \
         libffi-dev \
-        geos-dev \
-        proj-util \
-        proj-dev \
-        make
+        libgeos-dev
 # Setup backend Python dependencies
-COPY --from=extract-deps \
+COPY --chown=appuser:appuser --from=extract-deps \
     /opt/python/requirements.txt /opt/python/
+USER appuser:appuser
 RUN pip install --user --no-warn-script-location \
     --no-cache-dir -r /opt/python/requirements.txt
 
@@ -61,27 +61,25 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
     REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
 # Setup backend runtime dependencies
-RUN apk update && \
-    apk add --no-cache \
-        postgresql-libs geos proj-util
-COPY --from=build \
-    /root/.local \
+RUN apt-get update && \
+    apt-get install --no-install-recommends -y \
+        postgresql-client libgeos3.11.1 proj-bin && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+COPY --chown=appuser:appuser --from=build \
+    /home/appuser/.local \
     /home/appuser/.local
+USER appuser:appuser
 COPY backend backend/
 COPY migrations migrations/
 COPY scripts/world scripts/world/
 COPY scripts/database scripts/database/
 COPY manage.py .
-# Add non-root user, permissions, init log dir
-RUN adduser -D -u 900 -h /home/appuser -s /bin/false appuser \
-    && chown -R appuser:appuser /usr/src /home/appuser
 
 
 
 FROM runtime as debug
-RUN pip install --no-warn-script-location \
+RUN pip install --user --no-warn-script-location \
     --no-cache-dir debugpy==1.6.7
-USER appuser
 CMD ["python", "-m", "debugpy", "--wait-for-client", "--listen", "0.0.0.0:5678", \
     "-m", "gunicorn", "-c", "python:backend.gunicorn", "manage:application", \
     "--reload", "--log-level", "error"]
@@ -90,7 +88,9 @@ CMD ["python", "-m", "debugpy", "--wait-for-client", "--listen", "0.0.0.0:5678",
 
 FROM runtime as prod
 # Pre-compile packages to .pyc (init speed gains)
+USER root
 RUN python -c "import compileall; compileall.compile_path(maxlevels=10, quiet=1)"
-USER appuser
+USER appuser:appuser
+RUN python -m compileall .
 CMD ["gunicorn", "-c", "python:backend.gunicorn", "manage:application", \
     "--workers", "1", "--log-level", "error"]

scripts/docker/tasking-manager/Dockerfile

@@ -1,5 +1,5 @@
 ARG PYTHON_IMG_TAG=3.10
-FROM python:${PYTHON_IMG_TAG}-bullseye
+FROM python:${PYTHON_IMG_TAG}-bookworm
 
 RUN mkdir -p /usr/src/app
 WORKDIR /usr/src/app
@@ -10,7 +10,7 @@ ENV PATH="/usr/src/app/__pypackages__/${PYTHON_IMG_TAG}/bin:$PATH" \
 # INSTALLATION
 
 # Add repository for node
-RUN curl -sL https://deb.nodesource.com/setup_10.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_16.x | bash -
 
 # Install dependencies
 RUN apt-get update \