vikingowl
107f9e1f14
Multi-stage Alpine build pinned to python:3.14-alpine, with libolm pulled in only for the runtime layer. K8s manifests cover ServiceAccount, Role (scoped to a single named Secret), RoleBinding, ConfigMap, RWO PVC, and the CronJob itself (concurrencyPolicy=Forbid, runAsNonRoot, dropped caps, readOnlyRootFilesystem). Kustomize overlay targets the tenant-2 namespace. bootstrap-local.sh prepares ./local/ from a Claude install (honors CLAUDE_CONFIG_DIR for work/priv splits) and prompts for the Matrix bot credentials.
46 lines
984 B
Docker
46 lines
984 B
Docker
# syntax=docker/dockerfile:1.7
|
|
|
|
ARG PYTHON_VERSION=3.14
|
|
|
|
FROM python:${PYTHON_VERSION}-alpine AS builder
|
|
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_ROOT_USER_ACTION=ignore
|
|
|
|
RUN apk add --no-cache \
|
|
build-base \
|
|
libffi-dev \
|
|
olm-dev
|
|
|
|
WORKDIR /build
|
|
COPY requirements.txt .
|
|
|
|
RUN python -m venv /opt/venv \
|
|
&& /opt/venv/bin/pip install --upgrade pip \
|
|
&& /opt/venv/bin/pip install --no-cache-dir -r requirements.txt
|
|
|
|
|
|
FROM python:${PYTHON_VERSION}-alpine AS runtime
|
|
|
|
RUN apk add --no-cache \
|
|
olm \
|
|
ca-certificates \
|
|
&& addgroup -g 1000 bot \
|
|
&& adduser -u 1000 -G bot -h /home/bot -D bot \
|
|
&& mkdir -p /state \
|
|
&& chown -R bot:bot /state
|
|
|
|
COPY --from=builder /opt/venv /opt/venv
|
|
ENV PATH=/opt/venv/bin:$PATH \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONPATH=/app/src
|
|
|
|
WORKDIR /app
|
|
COPY --chown=bot:bot src/ ./src/
|
|
|
|
USER bot
|
|
|
|
ENTRYPOINT ["python", "-m", "claude_matrix_bot.reset_watcher"]
|