Dockerfile

# Generated by scripts/docker.py; edit docker/ templates, then make docker-generate.
# Experimental features: none
FROM python:3.12-slim-trixie AS builder


WORKDIR /build
COPY pyproject.toml LICENSE ./
COPY src ./src
# Python dependencies have one source of truth: pyproject.toml.
RUN python -m pip wheel --no-cache-dir --wheel-dir /wheels .


FROM python:3.12-slim-trixie AS runtime
# gpgv: signatures; gpg: key expiry; openssl/zstd: format backends;
# tini: PID 1; ca-certificates/tzdata: HTTPS and IANA warming schedules.
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates gpg gpgv openssl tini tzdata zstd \
    && rm -rf /var/lib/apt/lists/*
COPY --from=builder /wheels /wheels
RUN python -m pip install --no-cache-dir --no-index --find-links=/wheels repowatch \
    && rm -rf /wheels \
    && python -m pip check
RUN groupadd --gid 10001 repowatch \
    && useradd --uid 10001 --gid repowatch --create-home \
        --home-dir /var/lib/repowatch --shell /usr/sbin/nologin repowatch \
    && mkdir -p /etc/repowatch \
    && chown repowatch:repowatch /etc/repowatch

# Release initialization is bundled; development may bind-mount these inputs.
COPY docker/compose/init.py /bootstrap/init.py
COPY docker/compose/config.example.yaml /bootstrap/config.yaml
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 HOME=/var/lib/repowatch
USER repowatch
WORKDIR /var/lib/repowatch
RUN repowatch --help >/dev/null \
    && gpgv --version >/dev/null && gpg --version >/dev/null \
    && openssl version >/dev/null && zstd --version >/dev/null

VOLUME ["/var/lib/repowatch"]
EXPOSE 8085
ENTRYPOINT ["tini", "--", "repowatch"]
CMD ["-c", "/etc/repowatch/config.yaml", "run"]