Update Dockerfile to enhance security and caching for HuggingFace dependencies
Browse files- Dockerfile +20 -13
Dockerfile
CHANGED
@@ -2,32 +2,39 @@ FROM python:3.9-slim
|
|
2 |
|
3 |
WORKDIR /app
|
4 |
|
5 |
-
#
|
6 |
RUN apt-get update && apt-get install -y \
|
7 |
build-essential \
|
8 |
&& rm -rf /var/lib/apt/lists/*
|
9 |
|
10 |
-
#
|
|
|
|
|
|
|
|
|
|
|
11 |
COPY requirements.txt .
|
12 |
|
13 |
-
#
|
14 |
RUN pip install --no-cache-dir -r requirements.txt
|
15 |
|
16 |
-
#
|
17 |
COPY . .
|
18 |
|
19 |
-
#
|
20 |
-
|
21 |
-
|
|
|
|
|
22 |
|
23 |
-
#
|
24 |
-
RUN
|
|
|
|
|
25 |
|
26 |
-
#
|
27 |
-
|
28 |
|
29 |
-
# Expose the port the app runs on
|
30 |
EXPOSE 8000
|
31 |
|
32 |
-
# Command to run the application
|
33 |
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]
|
|
|
2 |
|
3 |
WORKDIR /app
|
4 |
|
5 |
+
# Установка системных зависимостей
|
6 |
RUN apt-get update && apt-get install -y \
|
7 |
build-essential \
|
8 |
&& rm -rf /var/lib/apt/lists/*
|
9 |
|
10 |
+
# Создание директорий с безопасными правами
|
11 |
+
RUN mkdir -p cache/huggingface vector_store chat_history \
|
12 |
+
&& chown -R 1000:1000 . \
|
13 |
+
&& chmod -R 755 .
|
14 |
+
|
15 |
+
# Копируем зависимости отдельно для кэширования
|
16 |
COPY requirements.txt .
|
17 |
|
18 |
+
# Установка Python-зависимостей
|
19 |
RUN pip install --no-cache-dir -r requirements.txt
|
20 |
|
21 |
+
# Копируем исходный код
|
22 |
COPY . .
|
23 |
|
24 |
+
# Настройка переменных окружения
|
25 |
+
ENV TRANSFORMERS_CACHE=/app/cache/huggingface
|
26 |
+
ENV HF_HOME=/app/cache/huggingface
|
27 |
+
ENV HUGGINGFACE_HUB_CACHE=/app/cache/huggingface
|
28 |
+
ENV XDG_CACHE_HOME=/app/cache
|
29 |
|
30 |
+
# Фиксируем права (только для вновь созданных файлов)
|
31 |
+
RUN chown -R 1000:1000 /app \
|
32 |
+
&& find /app -type d -exec chmod 755 {} \; \
|
33 |
+
&& find /app -type f -exec chmod 644 {} \;
|
34 |
|
35 |
+
# Запускаем от непривилегированного пользователя
|
36 |
+
USER 1000
|
37 |
|
|
|
38 |
EXPOSE 8000
|
39 |
|
|
|
40 |
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]
|