compliance-enforce/Dockerfile at main · arkoinc-ca/compliance-enforce · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# Multi-stage build for compliance-enforce.
# Stage 1: builder — resolves dependencies and produces a wheel.
# Stage 2: runtime — slim image with the wheel installed; entrypoint = compliance-enforce.
#
# Build args:
#   INCLUDE_PII=false  (default)  — set to "true" to install [pii] extra (spaCy models, large image)

ARG INCLUDE_PII=false

# TODO(P0-08): pin to digest — FROM python:3.11-slim-bookworm@sha256:<digest> AS builder
FROM python:3.11-slim-bookworm AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

WORKDIR /build

RUN apt-get update \
    && apt-get install -y --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*

COPY pyproject.toml README.md LICENSE ./
COPY src/ ./src/

RUN pip install --upgrade pip build \
    && python -m build --wheel --outdir /dist


# TODO(P0-08): pin to digest — FROM python:3.11-slim-bookworm@sha256:<digest> AS runtime
FROM python:3.11-slim-bookworm AS runtime

ARG INCLUDE_PII=false

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PATH="/opt/venv/bin:${PATH}" \
    COMPLIANCE_ENFORCE_HOST=0.0.0.0 \
    COMPLIANCE_ENFORCE_PORT=8888 \
    COMPLIANCE_ENFORCE_ENV=production

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && python -m venv /opt/venv

COPY --from=builder /dist/*.whl /tmp/
COPY requirements-hashed.txt /tmp/requirements-hashed.txt

# Install dependencies with hash verification, then the wheel.
# requirements-hashed.txt is generated by: uv export --output-file requirements-hashed.txt
RUN /opt/venv/bin/pip install --upgrade pip \
    && /opt/venv/bin/pip install --require-hashes -r /tmp/requirements-hashed.txt \
    && if [ "$INCLUDE_PII" = "true" ]; then \
         /opt/venv/bin/pip install --no-deps "/tmp/$(ls /tmp/*.whl | xargs -n1 basename)[pii]"; \
       else \
         /opt/venv/bin/pip install --no-deps /tmp/*.whl; \
       fi \
    && rm /tmp/*.whl /tmp/requirements-hashed.txt

# Non-root user: uid 10001 matches Kubernetes runAsUser in Helm chart.
RUN useradd --create-home --shell /bin/bash --uid 10001 appuser
USER appuser
WORKDIR /app

COPY --chown=appuser:appuser policies/ /app/policies/

LABEL org.opencontainers.image.title="compliance-enforce" \
      org.opencontainers.image.description="Runtime sidecar for PII scrubbing, DSR, consent, retention, and bias enforcement" \
      org.opencontainers.image.source="https://github.com/arkoinc-ca/compliance-enforce" \
      org.opencontainers.image.licenses="AGPL-3.0-only" \
      org.opencontainers.image.vendor="Arkoinc Inc." \
      org.opencontainers.image.version="0.3.0-dev"

EXPOSE 8888

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request, sys; r=urllib.request.urlopen('http://localhost:8888/healthz', timeout=4); sys.exit(0 if r.status==200 else 1)"

ENTRYPOINT ["compliance-enforce"]