Feat: Introduce multi-stage Docker build for optimized image size, update docker-compose for service dependencies and health checks, and add .dockerignore to exclude unnecessary files

Author: luisleo526

.dockerignore

@@ -0,0 +1,90 @@
+# Git files
+.git
+.gitignore
+.gitattributes
+
+# Python cache files
+__pycache__
+*.py[cod]
+*$py.class
+*.so
+.Python
+*.egg-info/
+dist/
+build/
+*.egg
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+.mypy_cache/
+.ruff_cache/
+
+# Virtual environments
+venv/
+env/
+ENV/
+.venv/
+
+# IDE files
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Docker files (avoid recursive copies)
+Dockerfile*
+docker-compose*.yml
+docker-compose*.yaml
+.dockerignore
+
+# Documentation
+*.md
+docs/
+README.md
+NGINX.md
+
+# Environment files (use secrets/configs instead)
+.env
+.env.*
+example.env
+
+# Volume directories (important to exclude)
+volume/
+./volume/
+
+# Database files
+*.db
+*.sqlite
+*.sqlite3
+
+# Logs
+*.log
+logs/
+
+# Test files
+tests/
+test_*.py
+*_test.py
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+.travis.yml
+
+# Scripts (unless needed in container)
+*.sh
+!minio-entrypoint.sh
+!init-minio.sh
+
+# Backup files
+*.bak
+*.backup
+mysql-backup/
+
+# Temporary files
+tmp/
+temp/
+*.tmp

.idea/.gitignore

@@ -1,31 +1,64 @@
-FROM ubuntu:jammy-20240530
+# Multi-stage build for optimized image size
+# Stage 1: Builder stage
+FROM python:3.11-slim as builder
 
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
 
-ENV PYTHONPATH="/run"
+WORKDIR /tmp
 
-# Set working directory for the application
-WORKDIR /run
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    g++ \
+    python3-dev \
+    libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
 
-# Update and install required packages, clean up lists to reduce image size
-RUN apt-get update -qq && apt-get upgrade -y -qq && \
-    apt-get install -y -qq --no-install-recommends \
-    python3.11 \
-    python3.11-dev \
-    python3.11-distutils \
-    python3-pip \
-    git \
-    build-essential && \
-    rm -rf /var/lib/apt/lists/*
+# Copy requirements and install Python dependencies
+COPY requirements.txt .
+RUN pip install --user --no-warn-script-location -r requirements.txt
 
-# Upgrade pip
-RUN python3.11 -m pip install --no-cache-dir --upgrade pip
+# Stage 2: Runtime stage
+FROM python:3.11-slim
 
-# Copy requirements.txt and install Python dependencies
-COPY ./requirements.txt /requirements.txt
-RUN python3.11 -m pip install --no-cache-dir --upgrade -r /requirements.txt
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH="/app" \
+    PATH="/home/appuser/.local/bin:${PATH}"
 
-# Copy the application code to the working directory
-#COPY . /app
+# Install runtime dependencies only
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
 
-# Command to run the application
-CMD ["python3.11", "-m", "fastapi", "dev", "src/server.py", "--host", "0.0.0.0", "--port", "8000"]
+# Create non-root user for security
+RUN useradd -m -u 1000 appuser && \
+    mkdir -p /app && \
+    chown -R appuser:appuser /app
+
+WORKDIR /app
+
+# Copy Python packages from builder
+COPY --from=builder --chown=appuser:appuser /root/.local /home/appuser/.local
+
+# Copy application code
+COPY --chown=appuser:appuser . /app
+
+# Switch to non-root user
+USER appuser
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD curl -f http://localhost:8000/health || exit 1
+
+# Expose the application port
+EXPOSE 8000
+
+# Default to production mode, but can be overridden in docker-compose
+CMD ["uvicorn", "src.server:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]

Dockerfile

@@ -11,14 +11,17 @@ services:
     env_file:
       - example.env
     volumes:
-      - ./src:/run/src
-      - ./alembic:/run/alembic
-      - ./alembic.ini:/run/alembic.ini
-      - ./run_alembic.sh:/run/run_alembic.sh
+      - ./src:/app/src
+      - ./alembic:/app/alembic
+      - ./alembic.ini:/app/alembic.ini
+      - ./run_alembic.sh:/app/run_alembic.sh
     environment:
-      - PYTHONPATH=/run
+      - PYTHONPATH=/app
       - DEV=true
-    command: "python3.11 -m fastapi run src/server.py --host 0.0.0.0 --port 8000 --reload"
+    depends_on:
+      - redis
+      - mysql
+      - minio
     networks:
       - shared_network
 
@@ -30,6 +33,11 @@ services:
       - shared_network
     volumes:
       - ./volume/redis_data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   mysql:
     container_name: template-mysql
@@ -45,35 +53,20 @@ services:
     command: --default-authentication-plugin=mysql_native_password
     networks:
       - shared_network
-
-  mysql-backup:
-    container_name: template-mysql-backup
-    build:
-      context: ./mysql-backup
-      dockerfile: Dockerfile
-    restart: always
-    depends_on:
-      - mysql
-    environment:
-      MYSQL_HOST: mysql
-      MYSQL_PORT: 3306
-      MYSQL_USER: root
-      MYSQL_PASSWORD: root
-      MYSQL_DATABASE: template_db
-      BACKUP_SCHEDULE: "0 2 * * *"  # Daily at 2 AM
-      BACKUP_RETENTION_DAYS: 7       # Keep backups for 7 days
-      BACKUP_ON_STARTUP: "true"      # Create backup when container starts
-    volumes:
-      - ./volume/mysql_backups:/backups
-    networks:
-      - shared_network
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
 
   adminer:
     container_name: template-adminer
     image: adminer
     restart: always
     ports:
       - "8001:8080"
+    depends_on:
+      - mysql
     networks:
       - shared_network
 
@@ -94,6 +87,11 @@ services:
       - shared_network
     entrypoint: /bin/sh
     command: ["/minio-entrypoint.sh"]
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
 
 networks:
   shared_network:

docker-compose.yaml

@@ -11,4 +11,5 @@ email-validator
 python-ulid[pydantic]
 redis[hiredis]
 boto3
-alembic
+alembic
+pwdlib[argon2]

requirements.txt

@@ -1,11 +1,12 @@
 from datetime import datetime, timedelta, timezone
 
 from jose import jwt
-from passlib.context import CryptContext
+# from passlib.context import CryptContext
+from pwdlib import PasswordHash
 
 from src.utils.handler import handle_jwt_error
 
-pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+pwd_context = PasswordHash.recommended() #CryptContext(schemes=["bcrypt"], deprecated="auto")
 
 SECRET_KEY = "c1b3e4b3-4b3c-4b3e-8b3c-4b3e4b3c4b3e"
 ALGORITHM = "HS256"