Dalton Alvarenga
f4a2ee44ca
All checks were successful
CD / build (pull_request) Successful in 5m2s
Adequa o repo ao guia de promoção lab -> homolog mantendo Python (Gate 0 via stackException). Cumpre os gates aplicáveis: - promotion-manifest.yaml: stackException (Python/Vanna), Gate B N/A, Gate D/G declarados, capacidade e deltas. - k8s/hml/: overlay homolog — secret DB dedicado (vanna-clubpetro-db, Gate G), probes httpGet /health (Gate E), resources.requests, replicas:1, non-root securityContext; host homologation.clubpetro.com (sem host de lab). - server.py: rota GET /health (alvo das probes). - Dockerfile: usuário non-root uid/gid 10001 + HOME/cache graváveis (Gate E). - .env.example: remove literal lab.clubpetro.com do CORS (Gate D). - k8s/ flat movido para k8s/lab/ (simetria lab/hml); cd.yml aplica k8s/lab/. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
69 lines
2.4 KiB
Docker
69 lines
2.4 KiB
Docker
# syntax=docker/dockerfile:1.6
|
|
# Multi-stage:
|
|
# 1) Clona vanna-ai/vanna upstream (commit pinned em 365d061) e builda o webcomponent (~7.5MB)
|
|
# 2) Imagem Python 3.11 com vanna editable + requirements + código do app
|
|
ARG VANNA_UPSTREAM_COMMIT=365d0617c1a4567ffee1b19b40c27feb4206bfcf
|
|
|
|
# ============================================================================
|
|
# Stage 1 — webcomponent (Node)
|
|
# ============================================================================
|
|
FROM node:20-bookworm-slim AS webcomponent
|
|
ARG VANNA_UPSTREAM_COMMIT
|
|
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /vanna
|
|
RUN git init -q \
|
|
&& git remote add origin https://github.com/vanna-ai/vanna.git \
|
|
&& git fetch --depth 50 origin "$VANNA_UPSTREAM_COMMIT" \
|
|
&& git checkout FETCH_HEAD
|
|
WORKDIR /vanna/frontends/webcomponent
|
|
RUN npm install --no-audit --no-fund --loglevel=error \
|
|
&& npm run build \
|
|
&& ls -lh dist/vanna-components.js
|
|
|
|
# ============================================================================
|
|
# Stage 2 — runtime Python
|
|
# ============================================================================
|
|
FROM python:3.11-slim-bookworm
|
|
ARG VANNA_UPSTREAM_COMMIT
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
git ca-certificates curl build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Copia o vanna upstream + bundle já buildado do stage 1
|
|
COPY --from=webcomponent /vanna /app/vanna
|
|
|
|
# Instala vanna editable
|
|
RUN pip install -e ./vanna
|
|
|
|
# Instala deps do app
|
|
COPY requirements.txt .
|
|
RUN pip install -r requirements.txt
|
|
|
|
# Código do app
|
|
COPY . .
|
|
|
|
# Gate E — usuário non-root. uid/gid 10001 batem com o securityContext do
|
|
# k8s/hml/deployment.yaml (runAsUser/fsGroup). HOME=/home/app pro cache do
|
|
# ChromaDB (~/.cache/chroma) cair num diretório gravável pelo usuário.
|
|
ENV HOME=/home/app
|
|
RUN groupadd -g 10001 app \
|
|
&& useradd -u 10001 -g 10001 -m -d /home/app -s /usr/sbin/nologin app \
|
|
&& mkdir -p /app/chroma_db /app/data_storage /home/app/.cache/chroma \
|
|
&& chown -R 10001:10001 /app /home/app
|
|
|
|
USER 10001
|
|
|
|
EXPOSE 8765
|
|
|
|
# `--workers 1` é OBRIGATÓRIO — múltiplos workers corrompem o SQLite do Chroma
|
|
CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8765", "--workers", "1"]
|