bstein/ariadne
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security(ariadne): harden image and bump jwt

Browse Source
This commit is contained in:
codex 2026-04-21 23:59:48 -03:00
parent e22a47b65e
commit 18d518b47a
4 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Dockerfile
View File

@ -5,8 +5,9 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
WORKDIR /app WORKDIR /app
COPY ariadne /app/ariadne COPY --chown=ariadne:ariadne ariadne /app/ariadne
EXPOSE 8080 EXPOSE 8080
USER ariadne
CMD ["uvicorn", "ariadne.app:app", "--host", "0.0.0.0", "--port", "8080"] CMD ["uvicorn", "ariadne.app:app", "--host", "0.0.0.0", "--port", "8080"]

7
Dockerfile.base
View File

@ -6,4 +6,9 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
WORKDIR /app WORKDIR /app
COPY requirements.txt /app/requirements.txt COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt RUN pip install --no-cache-dir -r /app/requirements.txt && \
addgroup --system ariadne && \
adduser --system --ingroup ariadne --home /app ariadne && \
chown -R ariadne:ariadne /app
USER ariadne

6
Dockerfile.ci
View File

@ -1,6 +1,10 @@
FROM registry.bstein.dev/bstein/ariadne-base:py312 FROM registry.bstein.dev/bstein/ariadne-base:py312
USER root
WORKDIR /app WORKDIR /app
COPY requirements-dev.txt /app/requirements-dev.txt COPY requirements-dev.txt /app/requirements-dev.txt
RUN pip install --no-cache-dir -r /app/requirements-dev.txt RUN pip install --no-cache-dir -r /app/requirements-dev.txt && \
chown -R ariadne:ariadne /app
USER ariadne

2
requirements.txt
View File

@ -2,7 +2,7 @@ fastapi==0.115.11
uvicorn[standard]==0.30.6 uvicorn[standard]==0.30.6
httpx==0.27.2 httpx==0.27.2
kubernetes==30.1.0 kubernetes==30.1.0
PyJWT[crypto]==2.10.1 PyJWT[crypto]==2.12.1
psycopg[binary]==3.2.6 psycopg[binary]==3.2.6
psycopg-pool==3.2.6 psycopg-pool==3.2.6
croniter==2.0.7 croniter==2.0.7