Infrastructure & Deployment
Docker Architecture & Multi-Stage Builds
Analysis of root Dockerfile, backend Dockerfile, entrypoint scripts, and security hardening.
Docker Architecture & Multi-Stage Builds
IMPLEMENTED
The production container image is defined in the root Dockerfile and backend/Dockerfile.
1. Multi-Stage Dockerfile Analysis
# Stage 1: Build Python dependencies
FROM python:3.12-slim AS builder
WORKDIR /app
RUN apt-get update && apt-get install -y gcc libpq-dev python3-dev
COPY backend/requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt
# Stage 2: Production runtime
FROM python:3.12-slim AS runner
WORKDIR /app
# Install only runtime shared libraries (libpq5, curl)
RUN apt-get update && apt-get install -y --no-install-recommends curl libpq5 && rm -rf /var/lib/apt/lists/*
# Security: Non-root execution
RUN groupadd -r -g 1001 appuser && useradd -r -u 1001 -g appuser -d /home/appuser -m appuser
COPY --from=builder --chown=appuser:appuser /root/.local /home/appuser/.local
COPY --chown=appuser:appuser backend/ .
USER appuser
RUN python manage.py collectstatic --noinput
EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD curl -f http://localhost:8000/healthz/ || exit 1
ENTRYPOINT ["/app/entrypoint.sh"]Key Security & Optimization Highlights:
- Zero Build Tools in Runtime: Compilers (
gcc) and headers (python3-dev,libpq-dev) are purged in Stage 2, reducing attack surface and image size. - Non-Root Execution: Runs strictly as
appuser(UID 1001). - Automated Healthcheck: Tests internal
/healthz/probe.