Dockerfile

# syntax=docker/dockerfile:1
# Prepare the base environment.
FROM python:3.13 AS builder_base

# This approximately follows this guide: https://hynek.me/articles/docker-uv/
# Which creates a standalone environment with the dependencies.
# - Silence uv complaining about not being able to use hard links,
# - tell uv to byte-compile packages for faster application startups,
# - prevent uv from accidentally downloading isolated Python builds,
# - pick a Python,
# - and finally declare `/app` as the target for `uv sync`.
ENV UV_LINK_MODE=copy \
  UV_COMPILE_BYTECODE=1 \
  UV_PYTHON_DOWNLOADS=never \
  UV_PROJECT_ENVIRONMENT=/app/.venv

COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /bin/

# Since there's no point in shipping lock files, we move them
# into a directory that is NOT copied into the runtime image.
# The trailing slash makes COPY create `/_lock/` automagically.
WORKDIR /_lock
COPY pyproject.toml uv.lock /_lock/

# Install OS requirements to build packages.
RUN apt-get update -y \
  && apt-get install -y gcc

# Synchronize dependencies.
# This layer is cached until uv.lock or pyproject.toml change.
RUN --mount=type=cache,target=/root/.cache uv sync --frozen --no-group dev

##################################################################################

FROM python:3.13
LABEL org.opencontainers.image.authors=asi@dbca.wa.gov.au
LABEL org.opencontainers.image.source=https://github.com/dbca-wa/caddy

# Install OS packages (gdal, etc.)
RUN apt-get update -y \
  && apt-get install -y gdal-bin proj-bin \
  && rm -rf /var/lib/apt/lists/*

# Create a non-root user.
RUN groupadd -r -g 1000 app \
  && useradd -r -u 1000 -d /app -g app -N app

WORKDIR /app
COPY --from=builder_base --chown=app:app /app /app
ENV PATH="/app/.venv/bin:$PATH" \
  # Run Python unbuffered:
  PYTHONUNBUFFERED=1

# Install the project.
COPY gunicorn.py manage.py ./
COPY caddy ./caddy
COPY shack ./shack
RUN python manage.py collectstatic --noinput
USER app
EXPOSE 8080
CMD ["gunicorn", "caddy.wsgi", "--config", "gunicorn.py"]