62 lines
3.7 KiB
Docker
62 lines
3.7 KiB
Docker
ARG PYTHON_BASE_IMAGE=python:3.12-slim@sha256:44ff437bba879d4941b710a369a8f19266aea34b29002807f0c487fabc9eec9b
|
|
|
|
FROM ${PYTHON_BASE_IMAGE} AS builder
|
|
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
YUQEI_MIN_GLIBC=2.28
|
|
|
|
ARG PIP_INDEX_URL=https://pypi.org/simple
|
|
WORKDIR /build
|
|
|
|
COPY yuqei-contract-platform/services/kms-gateway/vendor/alibaba-kms-modern /build/alibaba-kms-modern
|
|
COPY yuqei-contract-platform/services/kms-gateway/vendor/verify_dependency_closure.py /build/verify_dependency_closure.py
|
|
COPY yuqei-contract-platform/services/kms-gateway/pyproject.toml /build/kms-gateway-pyproject.toml
|
|
COPY yuqei-infra/requirements/kms-gateway-build-tools-py312.txt /build/build-tools.lock
|
|
COPY yuqei-infra/requirements/kms-gateway-runtime-linux-x86_64-py312.txt /build/runtime.lock
|
|
|
|
RUN python -c "import os, platform; name, version = platform.libc_ver(); minimum = tuple(map(int, os.environ['YUQEI_MIN_GLIBC'].split('.'))); actual = tuple(map(int, version.split('.')[:2])); assert name == 'glibc' and actual >= minimum, f'KMS gateway requires glibc >= {minimum[0]}.{minimum[1]}, found {name} {version}'"
|
|
RUN python -m pip install --no-cache-dir --only-binary=:all: --require-hashes \
|
|
--index-url "$PIP_INDEX_URL" \
|
|
--requirement /build/build-tools.lock
|
|
RUN python /build/alibaba-kms-modern/build_forks.py \
|
|
--work-dir /tmp/alibaba-kms-build \
|
|
--wheel-dir /build/alibaba-kms-wheels
|
|
RUN python -m pip download --no-cache-dir --no-build-isolation --no-deps --require-hashes \
|
|
--index-url "$PIP_INDEX_URL" \
|
|
--dest /build/runtime-inputs \
|
|
--requirement /build/runtime.lock
|
|
RUN python -m pip install --no-cache-dir --no-build-isolation --require-hashes \
|
|
--no-index --find-links /build/runtime-inputs \
|
|
--target /install \
|
|
--requirement /build/runtime.lock
|
|
RUN python -m pip install --no-cache-dir --no-deps --target /install \
|
|
/build/alibaba-kms-wheels/*.whl
|
|
RUN python /build/verify_dependency_closure.py \
|
|
--project /build/kms-gateway-pyproject.toml \
|
|
--path /install \
|
|
--forbid pyOpenSSL \
|
|
&& PYTHONPATH=/install python -m pip check \
|
|
&& PYTHONPATH=/install python -c "import importlib.metadata as m, importlib.util; from alibabacloud_kms_kms20160120.client import Client as AliClient; from openapi_util.protobuf import api_pb2; from tencentcloud.kms.v20190118.kms_client import KmsClient as TencentClient; assert AliClient and TencentClient; assert m.version('alibabacloud-kms-python-sdk') == '1.1.3+yuqei.1'; assert m.version('alibabacloud-dkms-gcs') == '1.0.2+yuqei.2'; assert m.version('protobuf') == '6.33.6'; assert m.version('cryptography') == '50.0.2'; assert importlib.util.find_spec('OpenSSL') is None; request = api_pb2.EncryptRequest(KeyId='docker-build', Plaintext=b'payload'); assert api_pb2.EncryptRequest.FromString(request.SerializeToString()) == request"
|
|
|
|
FROM ${PYTHON_BASE_IMAGE}
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONPATH=/opt/kms-python:/app/yuqei-contract-platform/services/kms-gateway/src
|
|
|
|
WORKDIR /app
|
|
|
|
COPY --from=builder /install /opt/kms-python
|
|
COPY yuqei-contract-platform/services/kms-gateway/src /app/yuqei-contract-platform/services/kms-gateway/src
|
|
|
|
RUN python -c "from alibabacloud_kms_kms20160120.client import Client as AliClient; from tencentcloud.kms.v20190118.kms_client import KmsClient as TencentClient; from openapi_util.protobuf import api_pb2; assert AliClient and TencentClient and api_pb2.EncryptRequest" \
|
|
&& addgroup --system --gid 10001 yuqei \
|
|
&& adduser --system --uid 10001 --ingroup yuqei yuqei
|
|
|
|
USER 10001:10001
|
|
EXPOSE 8102
|
|
CMD ["python", "-m", "uvicorn", "yuqei_kms_gateway.main:app", "--host", "0.0.0.0", "--port", "8102"]
|
|
|