Merge pull request #19 from letsbuilda/sd/docker

try pinning docker image to sha

Author: shenanigansd

Dockerfile

@@ -1,11 +1,18 @@
-FROM --platform=linux/amd64 python:slim-bullseye
+FROM --platform=linux/amd64 python:3.11-slim@sha256:66e41d125c90d679ad69b264ac7b78a3bd27e7510b63ba5987ad42678bbefc32
+
+RUN adduser --disabled-password api
+USER api
+
+ENV PATH="${PATH}:/home/api/.local/bin"
 
 # Set Git SHA environment variable
 ARG git_sha="development"
 ENV GIT_SHA=$git_sha
 
-COPY . .
+WORKDIR /app
+COPY pyproject.toml src ./
+RUN python -m pip install .
 
-RUN pip install .
+EXPOSE 8080
 
 CMD ["uvicorn", "api.server:app", "--host", "0.0.0.0", "--port", "8080"]

docs/source/changelog.rst

@@ -4,6 +4,9 @@
 Changelog
 =========
 
+- :release:`1.5.0 <28th February 2023>`
+- :feature:`17` Pin the Docker image to a specific SHA-256 digest to help with reproducible builds
+
 - :release:`1.4.0 <20th February 2023>`
 - :feature:`13` Actually add ``GIT_SHA`` to ``Dockerfile``
 

src/api/__init__.py

@@ -1,3 +1,3 @@
 """Public API for our projects"""
 
-__version__ = "1.4.0"
+__version__ = "1.5.0"