992e2c47b3
Closes the unpinned-deps gotcha that broke production once already (Starlette 1.0 shipping in 2026-04 changed the TemplateResponse signature; our floating requirements.txt picked it up on the next rebuild and the dashboard 500'd until 1.0.0-12 patched the call sites). Mechanics: * `requirements.in` — human-edited input, identical contents to the old `requirements.txt`. * `requirements.txt` — now an autogenerated lockfile (876 lines, every transitive pinned with sha256 hashes). Regenerated via `scripts/regenerate-lockfile.sh`, which runs `pip-compile --generate-hashes --strip-extras` in a clean python:3.12-slim container so the script has no host dependencies. * Dockerfile installs with `pip install --require-hashes` — refuses any package whose sha256 doesn't match the lockfile, defending against compromised PyPI mirrors and accidental version drift. Verification: * Container boots clean on the hash-locked install (1.0.0-25). * /health returns 200 with all checks green. * Daily security scan (pip-audit + bandit + gitleaks) returns 0 findings against the new lockfile. Future deps changes: edit requirements.in, run the regenerate script, review the diff, rebuild, commit both files. README §"Updating dependencies" walks through it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
20 lines
806 B
Docker
20 lines
806 B
Docker
FROM python:3.12-slim
|
|
|
|
WORKDIR /opt/app
|
|
|
|
# Bump pip to a version with no known CVEs before installing anything.
|
|
# Without this, pip-audit flags CVE-2025-8869, CVE-2026-1703, CVE-2026-3219
|
|
# in pip itself. Pinned floor; pip is forward-compatible across 26.x.
|
|
RUN pip install --no-cache-dir --upgrade "pip>=26.0"
|
|
|
|
# requirements.txt is a fully-pinned lockfile generated from
|
|
# requirements.in via pip-compile (see scripts/regenerate-lockfile.sh).
|
|
# --require-hashes refuses to install any package whose sha256 doesn't
|
|
# match a hash in the file — defends against compromised upstream
|
|
# mirrors and accidental version drift.
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir --require-hashes -r requirements.txt
|
|
|
|
COPY app/ ./app/
|
|
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8084"]
|