c0ce3524b6
Base images - api, llm, docs(extract), notebooks(wheel): uv:python3.13-bookworm-slim -> uv:0.13.2-python3.13-trixie-slim. Debian 12 left regular security support in June 2026; a pinned uv tag makes base changes a reviewed diff Renovate can bump. notebooks copies /uv from the same tag instead of uv:latest. - api, llm: `uv sync --locked` — a stale lock now fails the build instead of silently re-resolving to packages pkg-supply-chain never scanned. - api, llm: uninstall the base image's system pip. Nothing runs it (uv owns the venv), and its vendored certifi/urllib3/msgpack/setuptools were the image's only language-level findings. - notebooks: the workspace resolves at build time with no committed lock, so it gets the same 7-day cooldown via ENV UV_EXCLUDE_NEWER (ENV, not a prefix — the recorded span must match at `uv run` time). - docs: pnpm 10.12.1 -> 10.34.7 to match packageManager. trivy HIGH/CRITICAL, deployed image -> this build: api 11 crit / 94 high -> 0 / 48 llm 9 / 129 -> 1 / 70 docs 0 / 38 -> 0 / 0 mc 2 / 52 -> 0 / 0 What's left is Debian `affected` with no fix released (libxml2 is the llm critical); the weekly Harden --pull rebuild picks fixes up as they land. mc sidecar MinIO archived the open-source client: quay.io/minio/mc answers 401, dl.min.io 410 Gone, and there are no more security fixes. The service keeps its name but ships rustfs/rc v0.1.36 on alpine:3.24 — same alias grammar (RC_HOST_local=http://key:secret@rustfs:9000), same admin verbs (`docker exec mc rc admin policy create local/ <name> <file>`), same hardening (uid 10002, read-only root, no caps). Verified against the live RustFS: `rc ls local/` lists all six buckets, `rc admin user list` reaches the admin API. Config dir moves to a tmpfs at /home/mc/.config/rc. Refs #1365
58 lines
1.7 KiB
Docker
58 lines
1.7 KiB
Docker
# Stage 1: Extract docs from Python source + export bib library
|
|
FROM ghcr.io/astral-sh/uv:0.13.2-python3.13-trixie-slim AS extract
|
|
|
|
WORKDIR /build
|
|
|
|
# Copy source code and extraction scripts
|
|
COPY src/ src/
|
|
COPY docs/scripts/ docs/scripts/
|
|
|
|
# Extract API docs via griffe (pure AST, no imports)
|
|
RUN uv run --with griffe python docs/scripts/extract_docs.py
|
|
|
|
# Bibliography: library.json is pre-generated on the host via
|
|
# uv run --with pydantic python docs/scripts/export_library.py
|
|
# and lives in docs/static/library.json (gitignored, 193MB).
|
|
# It's included in the build via COPY docs/static/ in stage 2.
|
|
# We don't regenerate inside Docker because bib.sqlite is 234MB,
|
|
# may be locked by the backfill, and corrupts on concurrent read.
|
|
|
|
|
|
# Stage 2: Build Docusaurus static site
|
|
FROM node:22-slim AS build
|
|
|
|
RUN corepack enable && corepack prepare pnpm@10.34.7 --activate
|
|
|
|
WORKDIR /docs
|
|
|
|
# Install dependencies (pnpm for deterministic, fast installs)
|
|
COPY docs/package.json docs/pnpm-lock.yaml ./
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
# Copy Docusaurus config and source
|
|
COPY docs/docusaurus.config.js docs/sidebars.js docs/babel.config.js docs/tsconfig.json ./
|
|
COPY docs/src/ src/
|
|
COPY docs/static/ static/
|
|
COPY docs/docs/ docs/
|
|
|
|
# Copy generated API docs from extract stage
|
|
COPY --from=extract /build/docs/docs/api/ docs/api/
|
|
COPY docs/docs/api/index.md docs/api/index.md
|
|
|
|
RUN pnpm build
|
|
|
|
|
|
# Stage 3: Serve with nginx
|
|
# hadolint ignore=DL3006
|
|
FROM nginx:alpine
|
|
|
|
RUN apk upgrade --no-cache
|
|
|
|
COPY --from=build /docs/build /usr/share/nginx/html
|
|
COPY docs/nginx.conf /etc/nginx/conf.d/default.conf
|
|
|
|
EXPOSE 80
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
CMD wget -qO /dev/null http://127.0.0.1:80/ || exit 1
|