2020-10-04 00:00:47 +02:00
|
|
|
FROM python:3.8-alpine3.12 as base
|
2019-12-24 06:36:32 +01:00
|
|
|
|
|
|
|
|
# Copy the requirements & code and install them
|
|
|
|
|
# Do this in a separate image in a separate directory
|
|
|
|
|
# to not have all the build stuff in the final image
|
2020-10-04 00:00:47 +02:00
|
|
|
FROM base AS builder_gosu
|
|
|
|
|
|
|
|
|
|
ENV GOSU_VERSION 1.12
|
|
|
|
|
|
|
|
|
|
RUN apk add --no-cache --virtual .build-deps \
|
|
|
|
|
ca-certificates \
|
|
|
|
|
dpkg \
|
|
|
|
|
gnupg \
|
|
|
|
|
&& dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \
|
|
|
|
|
&& wget -O /usr/local/bin/gosu https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${dpkgArch} \
|
|
|
|
|
&& wget -O /usr/local/bin/gosu.asc https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${dpkgArch}.asc \
|
|
|
|
|
# verify the signature
|
|
|
|
|
&& export GNUPGHOME="$(mktemp -d)" \
|
|
|
|
|
&& gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
|
|
|
|
|
&& gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
|
|
|
|
|
&& command -v gpgconf && gpgconf --kill all || true \
|
|
|
|
|
&& rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc \
|
|
|
|
|
&& chmod +x /usr/local/bin/gosu \
|
|
|
|
|
# check installation
|
|
|
|
|
&& gosu --version \
|
|
|
|
|
&& gosu nobody true \
|
|
|
|
|
&& apk del --no-cache \
|
|
|
|
|
.build-deps \
|
|
|
|
|
&& rm -rf /var/cache/apk/* \
|
|
|
|
|
&& rm -rf /tmp/*
|
|
|
|
|
|
|
|
|
|
FROM base AS builder_dependencies
|
|
|
|
|
|
2021-02-08 00:04:06 +01:00
|
|
|
WORKDIR /code
|
2020-10-04 00:00:47 +02:00
|
|
|
|
2021-02-08 00:04:06 +01:00
|
|
|
COPY docker/docker-requirements.txt .
|
|
|
|
|
|
|
|
|
|
# Install requirements
|
2020-10-04 00:00:47 +02:00
|
|
|
RUN apk add --no-cache --virtual .build-deps \
|
|
|
|
|
build-base \
|
|
|
|
|
libffi-dev \
|
|
|
|
|
&& mkdir /install \
|
2021-02-08 00:04:06 +01:00
|
|
|
&& python -m pip install \
|
|
|
|
|
--no-warn-script-location \
|
|
|
|
|
--prefix=/install \
|
|
|
|
|
--requirement docker-requirements.txt
|
|
|
|
|
|
|
|
|
|
# Install pypiserver
|
|
|
|
|
# - do this separately from deps so that when developing, every change does not
|
|
|
|
|
# require reinstalling deps
|
|
|
|
|
COPY pypiserver pypiserver
|
|
|
|
|
COPY setup.cfg .
|
|
|
|
|
COPY setup.py .
|
2023-08-15 11:16:30 +02:00
|
|
|
COPY README.md .
|
2021-02-08 00:04:06 +01:00
|
|
|
RUN python -m pip install --no-warn-script-location --prefix=/install .
|
2019-12-24 06:36:32 +01:00
|
|
|
|
|
|
|
|
FROM base
|
2021-02-08 00:04:06 +01:00
|
|
|
|
|
|
|
|
WORKDIR /data
|
2020-10-04 00:00:47 +02:00
|
|
|
# Copy the libraries installed via pip
|
|
|
|
|
COPY --from=builder_dependencies /install /usr/local
|
|
|
|
|
COPY --from=builder_gosu /usr/local/bin/gosu /usr/local/bin/gosu
|
Docker improvements (#365)
* Docker improvements
This addresses much of what was brought up in #359. Specifically, it:
- Significantly improves testing for the Docker image, adding a
`docker/test_docker.py` file using the regular pytest machinery to
set up and run docker images for testing
- Hopefully addresses a variety of permissions issues, by being explicit
about what access pypiserver needs and asking for it, only erroring
if that access is not available
- Requires RX permissions on `/data` (R to read files, X to list files
and to be able to cd into the directory. This is important since
`/data` is the `WORKDIR`)
- Requires RWX permissions on `/data/packages`, so that we can list
packages, write packages, and read packages.
- When running in the default configuration (as root on Linux or
as the pypiserver-named rootish user on Mac), with no volumes
mounted, these requirements are all satisfied
- Volume mounts still must be readable by the pypiserver user (UID
9898) in order for the container to run. However, we now error early
if this is not the case, and direct users to a useful issue.
- If the container is run as a non-root, non-pypiserver user (e.g.
because someone ran `docker run --user=<user_id>`, we try to run
pypiserver as that user). Provided that user has access to the
necessary directories, it should run fine.
- Fixes issues with running help and similar commands
- Updates the Docker image to use `PYPISERVER_PORT` for port
specification, while still falling back to `PORT` for backwards
compatibility
- Moves some docker-related things into a `/docker` directory
- Adds a `Makefile` for building a test fixture package sdist and wheel,
so that test code can call `make mypkg` and not need to worry about it
potentially building multiple times
The only issue #359 raises that's not addressed here is the one of
running pypiserver in the Docker container using some non-default server
for performance. I would like to do some benchmarking before deciding on
what to do there.
2021-02-06 18:28:15 +01:00
|
|
|
COPY docker/entrypoint.sh /entrypoint.sh
|
2021-02-08 00:04:06 +01:00
|
|
|
COPY docker/gunicorn.conf.py /data
|
2015-10-26 23:58:03 +01:00
|
|
|
|
2020-10-06 03:13:16 +02:00
|
|
|
# Use a consistent user and group ID so that linux users
|
|
|
|
|
# can create a corresponding system user and set permissions
|
|
|
|
|
# if desired.
|
2020-10-10 15:12:06 +02:00
|
|
|
RUN apk add bash \
|
|
|
|
|
&& rm -rf /var/cache/apk/* \
|
|
|
|
|
&& rm -rf /tmp/* \
|
|
|
|
|
&& addgroup -S -g 9898 pypiserver \
|
|
|
|
|
&& adduser -S -u 9898 -G pypiserver pypiserver --home /data\
|
2019-01-30 09:20:58 +01:00
|
|
|
&& mkdir -p /data/packages \
|
Docker improvements (#365)
* Docker improvements
This addresses much of what was brought up in #359. Specifically, it:
- Significantly improves testing for the Docker image, adding a
`docker/test_docker.py` file using the regular pytest machinery to
set up and run docker images for testing
- Hopefully addresses a variety of permissions issues, by being explicit
about what access pypiserver needs and asking for it, only erroring
if that access is not available
- Requires RX permissions on `/data` (R to read files, X to list files
and to be able to cd into the directory. This is important since
`/data` is the `WORKDIR`)
- Requires RWX permissions on `/data/packages`, so that we can list
packages, write packages, and read packages.
- When running in the default configuration (as root on Linux or
as the pypiserver-named rootish user on Mac), with no volumes
mounted, these requirements are all satisfied
- Volume mounts still must be readable by the pypiserver user (UID
9898) in order for the container to run. However, we now error early
if this is not the case, and direct users to a useful issue.
- If the container is run as a non-root, non-pypiserver user (e.g.
because someone ran `docker run --user=<user_id>`, we try to run
pypiserver as that user). Provided that user has access to the
necessary directories, it should run fine.
- Fixes issues with running help and similar commands
- Updates the Docker image to use `PYPISERVER_PORT` for port
specification, while still falling back to `PORT` for backwards
compatibility
- Moves some docker-related things into a `/docker` directory
- Adds a `Makefile` for building a test fixture package sdist and wheel,
so that test code can call `make mypkg` and not need to worry about it
potentially building multiple times
The only issue #359 raises that's not addressed here is the one of
running pypiserver in the Docker container using some non-default server
for performance. I would like to do some benchmarking before deciding on
what to do there.
2021-02-06 18:28:15 +01:00
|
|
|
&& chmod +x /entrypoint.sh
|
2019-01-30 09:20:58 +01:00
|
|
|
|
2019-12-24 06:36:32 +01:00
|
|
|
VOLUME /data/packages
|
Docker improvements (#365)
* Docker improvements
This addresses much of what was brought up in #359. Specifically, it:
- Significantly improves testing for the Docker image, adding a
`docker/test_docker.py` file using the regular pytest machinery to
set up and run docker images for testing
- Hopefully addresses a variety of permissions issues, by being explicit
about what access pypiserver needs and asking for it, only erroring
if that access is not available
- Requires RX permissions on `/data` (R to read files, X to list files
and to be able to cd into the directory. This is important since
`/data` is the `WORKDIR`)
- Requires RWX permissions on `/data/packages`, so that we can list
packages, write packages, and read packages.
- When running in the default configuration (as root on Linux or
as the pypiserver-named rootish user on Mac), with no volumes
mounted, these requirements are all satisfied
- Volume mounts still must be readable by the pypiserver user (UID
9898) in order for the container to run. However, we now error early
if this is not the case, and direct users to a useful issue.
- If the container is run as a non-root, non-pypiserver user (e.g.
because someone ran `docker run --user=<user_id>`, we try to run
pypiserver as that user). Provided that user has access to the
necessary directories, it should run fine.
- Fixes issues with running help and similar commands
- Updates the Docker image to use `PYPISERVER_PORT` for port
specification, while still falling back to `PORT` for backwards
compatibility
- Moves some docker-related things into a `/docker` directory
- Adds a `Makefile` for building a test fixture package sdist and wheel,
so that test code can call `make mypkg` and not need to worry about it
potentially building multiple times
The only issue #359 raises that's not addressed here is the one of
running pypiserver in the Docker container using some non-default server
for performance. I would like to do some benchmarking before deciding on
what to do there.
2021-02-06 18:28:15 +01:00
|
|
|
ENV PYPISERVER_PORT=8080
|
|
|
|
|
# PORT is deprecated. Please use PYPISERVER_PORT instead
|
|
|
|
|
ENV PORT=$PYPISERVER_PORT
|
2021-02-08 00:04:06 +01:00
|
|
|
# Flush logs immediately to stdout
|
|
|
|
|
ENV PYTHONUNBUFFERED=t
|
Docker improvements (#365)
* Docker improvements
This addresses much of what was brought up in #359. Specifically, it:
- Significantly improves testing for the Docker image, adding a
`docker/test_docker.py` file using the regular pytest machinery to
set up and run docker images for testing
- Hopefully addresses a variety of permissions issues, by being explicit
about what access pypiserver needs and asking for it, only erroring
if that access is not available
- Requires RX permissions on `/data` (R to read files, X to list files
and to be able to cd into the directory. This is important since
`/data` is the `WORKDIR`)
- Requires RWX permissions on `/data/packages`, so that we can list
packages, write packages, and read packages.
- When running in the default configuration (as root on Linux or
as the pypiserver-named rootish user on Mac), with no volumes
mounted, these requirements are all satisfied
- Volume mounts still must be readable by the pypiserver user (UID
9898) in order for the container to run. However, we now error early
if this is not the case, and direct users to a useful issue.
- If the container is run as a non-root, non-pypiserver user (e.g.
because someone ran `docker run --user=<user_id>`, we try to run
pypiserver as that user). Provided that user has access to the
necessary directories, it should run fine.
- Fixes issues with running help and similar commands
- Updates the Docker image to use `PYPISERVER_PORT` for port
specification, while still falling back to `PORT` for backwards
compatibility
- Moves some docker-related things into a `/docker` directory
- Adds a `Makefile` for building a test fixture package sdist and wheel,
so that test code can call `make mypkg` and not need to worry about it
potentially building multiple times
The only issue #359 raises that's not addressed here is the one of
running pypiserver in the Docker container using some non-default server
for performance. I would like to do some benchmarking before deciding on
what to do there.
2021-02-06 18:28:15 +01:00
|
|
|
EXPOSE $PYPISERVER_PORT
|
2020-10-04 00:00:47 +02:00
|
|
|
|
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|