🔒 Add .dockerignore: keep .env / .venv out of image layers; pin Python 3.13 - #2
Open
luiscosio wants to merge 1 commit into
Open
🔒 Add .dockerignore: keep .env / .venv out of image layers; pin Python 3.13#2luiscosio wants to merge 1 commit into
luiscosio wants to merge 1 commit into
Conversation
Both Dockerfiles COPY . . and Docker does not read .gitignore, so a developer building with a real .env present would bake HUGGINGFACE_HUB_TOKEN and API_KEY into an image layer permanently (a later rm does not remove layer contents). docker-compose.yml already bind-mounts ./.env:/app/.env:ro at runtime, so the build never needs it. Also excludes .venv (~1 GB locally) and generated transcript artifacts; build context drops from ~1 GB to ~41 kB. *.txt is excluded with a !requirements.txt negation because both Dockerfiles COPY requirements.txt before the main COPY. Also: pin Python 3.13 via .python-version, update README prerequisites, and document in the CUDA Dockerfile why the ubuntu22.04 base is correct (Python 3.13 already comes from deadsnakes, not the system 3.10). Verified with a dummy .env and a populated 981 MB .venv in the context: probe image with the same COPY directives shows .env and .venv absent, requirements.txt and all app files present.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1, which merged before this landed on that branch.
Secret-leak fix
There was no
.dockerignore, and both Dockerfiles runCOPY . .(Dockerfile:50,Dockerfile.cpu:30). Docker does not read.gitignore, so the entire working directory enters the build context:.env(holdingHUGGINGFACE_HUB_TOKEN/API_KEY, per.env.example) would be baked into an image layer permanently — deleting it in a later layer does not remove it from layer history.docker-compose.ymlalready bind-mounts./.env:/app/.env:roat runtime for both services, so the build-time copy had no upside..venv(~1 GB with torch/whisperx installed) was also entering the context on every build, and could shadow the container's site-packages.The new
.dockerignoreexcludes.env,.venv,.git,__pycache__,input/*,output/*, and the generated transcript artifacts mirrored from.gitignore.*.txtis excluded with a!requirements.txtnegation because both DockerfilesCOPY requirements.txt .before the main copy — getting that wrong breaks the build.Measured effect: build context drops from ~1 GB to ~41 kB.
Runtime standardization (org: Python 3.13)
.python-version→3.13(uv picks it up for dev envs)Dockerfile: comment documenting that the ubuntu22.04 base is correct — Python 3.13 is installed from deadsnakes and set as default viaupdate-alternatives(the system 3.10 is unused), and the ubuntu24.04 base would ship 3.12, i.e. further from target. No functional change; whisperx caps at<3.14, making 3.13 the org-wide ceiling.Verification
With a dummy
.env(hf_dummy_not_real) and a populated 981 MB.venvdeliberately present in the working directory:COPY requirements.txt .+COPY . .against this context/app/.envin image/app/.venvin image/app/requirements.txtin imagesecure_speech_to_text.py,utils/,best_effort_delete.py, compose,.env.example).dockerignoreonly affects what enters the build context, so a minimal probe image with identical COPY directives verifies the exclusion semantics without a full ~10-minute torch build. The full torch image was already built and functionally verified in #1; nothing in this PR changes what gets installed. Full CUDA-image behavior on a GPU host remains unverified here (no GPU on this machine, base image is amd64-oriented).The dummy
.envwas deleted before commit;git statusclean.