Ryan Malloy
89cdeb0967
Use MCNOAA_CHARTS_DIR env var (defaults to artifacts/charts/ for local dev) so the container's nobody user can write HTML charts to /tmp/charts instead of the read-only /app working directory.
30 lines
746 B
Docker
30 lines
746 B
Docker
# --- Dependencies ---
|
|
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim AS deps
|
|
WORKDIR /app
|
|
|
|
COPY pyproject.toml uv.lock README.md ./
|
|
COPY src/ src/
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-editable --extra viz
|
|
|
|
# --- Runtime ---
|
|
FROM python:3.12-slim-bookworm AS runtime
|
|
WORKDIR /app
|
|
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
ENV MPLCONFIGDIR=/tmp/matplotlib
|
|
ENV MCNOAA_CHARTS_DIR=/tmp/charts
|
|
|
|
COPY --from=deps /app/.venv /app/.venv
|
|
COPY src/ src/
|
|
|
|
EXPOSE 8000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD python -c "import socket; s=socket.create_connection(('127.0.0.1',8000),timeout=3); s.close()" || exit 1
|
|
|
|
USER nobody
|
|
CMD ["mcnoaa-tides"]
|