From 54193cafa32ac479fe29778d862e7e07969badc0 Mon Sep 17 00:00:00 2001
From: Jos Nienhuis <6952249+joszz@users.noreply.github.com>
Date: Mon, 5 Oct 2026 10:49:45 +0200
Subject: [PATCH] fix(docker): install only the main dependency group in the
 image

poetry install without --only main also installs the dev group, so the
runtime venv shipped pytest, mypy, pylint, ruff, pre-commit and their
dependencies, virtualenv among them, which image scanners flag. None of
it runs in the container: CI runs the checks on the runner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5b8f3509..6060149e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,7 +12,7 @@ COPY pyproject.toml poetry.lock /usr/src/app/
 
 # Install the dependencies and clear the cache afterwards.
 #   This may save some MBs.
-RUN poetry install --no-root && rm -rf $POETRY_CACHE_DIR
+RUN poetry install --no-root --only main && rm -rf $POETRY_CACHE_DIR
 
 # Now let's build the runtime image from the builder.
 #   We'll just copy the env and the PATH reference.