···11-FROM python:3.12-slim-bookworm
11+FROM python:3.12-alpine
22COPY --from=ghcr.io/astral-sh/uv:0.7.12 /uv /uvx /bin/
3344+# Install build tools & runtime dependencies
55+RUN apk add --no-cache \
66+ ffmpeg \
77+ file \
88+ libmagic
99+1010+RUN mkdir -p /app/data
411WORKDIR /app
51266-RUN \
77- --mount=type=cache,id=apt-cache,target=/var/cache/apt,sharing=locked \
88- --mount=type=cache,id=apt-lib-cache,target=/var/lib/apt,sharing=locked \
99- apt-get update; \
1010- apt-get dist-upgrade -yq; \
1111- apt-get install -y --no-install-recommends \
1212- ffmpeg \
1313- libmagic1
1313+# switch to a non-root user
1414+RUN adduser -D -u 1000 app && \
1515+ chown -R app:app /app
1616+USER app
14171518# Enable bytecode compilation
1619ENV UV_COMPILE_BYTECODE=1
···1922ENV UV_LINK_MODE=copy
20232124# Install the project's dependencies using the lockfile and settings
2525+COPY ./uv.lock ./pyproject.toml /app/
2226RUN --mount=type=cache,target=/root/.cache/uv \
2323- --mount=type=bind,source=uv.lock,target=uv.lock \
2424- --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
2527 uv sync --locked --no-install-project --no-dev
26282729# Define app data volume
2830VOLUME /app/data
29313032# Then, add the rest of the project source code and install it
3131-# Installing separately from its dependencies allows optimal layer caching
3233COPY . /app
3334RUN --mount=type=cache,target=/root/.cache/uv \
3435 uv sync --locked --no-dev
···3738ENV PATH="/app/.venv/bin:$PATH"
38393940# Set entrypoint to run the app using uv
4040-ENTRYPOINT ["uv", "run", "main.py"]4141+ENTRYPOINT ["uv", "run", "main.py"]
-36
Containerfile-alpine
···11-FROM python:3.12-alpine
22-COPY --from=ghcr.io/astral-sh/uv:0.7.12 /uv /uvx /bin/
33-44-WORKDIR /app
55-66-# Install build tools & runtime dependencies
77-RUN apk add --no-cache \
88- ffmpeg \
99- file \
1010- libmagic
1111-1212-# Enable bytecode compilation
1313-ENV UV_COMPILE_BYTECODE=1
1414-1515-# Copy from the cache instead of linking since it's a mounted volume
1616-ENV UV_LINK_MODE=copy
1717-1818-# Install the project's dependencies using the lockfile and settings
1919-RUN --mount=type=cache,target=/root/.cache/uv \
2020- --mount=type=bind,source=uv.lock,target=uv.lock \
2121- --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
2222- uv sync --locked --no-install-project --no-dev
2323-2424-# Define app data volume
2525-VOLUME /app/data
2626-2727-# Then, add the rest of the project source code and install it
2828-COPY . /app
2929-RUN --mount=type=cache,target=/root/.cache/uv \
3030- uv sync --locked --no-dev
3131-3232-# Place executables in the environment at the front of the path
3333-ENV PATH="/app/.venv/bin:$PATH"
3434-3535-# Set entrypoint to run the app using uv
3636-ENTRYPOINT ["uv", "run", "main.py"]