Dockerfile

# Multi-stage Dockerfile for ExploitRank
# Build stage
FROM python:3.12.12-slim@sha256:f3fa41d74a768c2fce8016b98c191ae8c1bacd8f1152870a3f9f87d350920b7c AS builder

WORKDIR /app

# Install a pinned uv binary.
COPY --from=ghcr.io/astral-sh/uv:0.10.0@sha256:78a7ff97cd27b7124a5f3c2aefe146170793c56a1e03321dd31a289f6d82a04f /uv /usr/local/bin/uv

# Copy only the package inputs required for a locked, non-editable runtime install.
COPY pyproject.toml uv.lock README.md ./
COPY eie/ ./eie/
COPY api/ ./api/

# Install runtime dependencies and the application. Development tools never
# enter the production environment.
ENV UV_PROJECT_ENVIRONMENT=/opt/venv
RUN uv sync --locked --no-dev --no-editable --no-cache

# Production stage
FROM python:3.12.12-slim@sha256:f3fa41d74a768c2fce8016b98c191ae8c1bacd8f1152870a3f9f87d350920b7c AS production

# The pinned base preserves provenance, but Debian security updates can land
# after the image is published. Apply available fixes before the image is
# scanned and released, then discard package indexes.
RUN apt-get update && \
    apt-get upgrade --yes --no-install-recommends && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv

# Create non-root user
RUN useradd --create-home --shell /bin/bash appuser && \
    chown -R appuser:appuser /app /opt/venv
USER appuser

# Set PATH to use virtual environment
ENV PATH="/opt/venv/bin:$PATH"

# Expose port
EXPOSE 8000

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)"]

# Run the API server
CMD ["python", "-m", "api.main"]