Skip to content

Avoid duplicating user directory files in Docker layers #358

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnthagen merged 1 commit into from
Jul 31, 2026
Merged

Avoid duplicating user directory files in Docker layers #358

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 10 additions & 14 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,9 @@ WORKDIR ${WORKDIR}

# Install any system dependencies required to build wheels, such as C compilers or system packages
# For example:
#RUN apt-get update && apt-get install -y \
# RUN apt-get update && apt-get install -y --no-install-recommends \
# gcc \
# && rm -rf /var/lib/apt/lists/*
# && rm -rf /var/lib/apt/lists/*

# Install uv into the global environment to isolate it from the venv it creates.
RUN pip install "uv==${UV_VERSION}"
Expand Down Expand Up @@ -67,15 +67,14 @@ ENV UV_PROJECT_ENVIRONMENT=/opt/venv
ENV HOME=/home/user
ENV APP_HOME=${HOME}/app

# Create the home directory for the new user.
RUN mkdir -p ${HOME}

# Create the user so the program doesn't run as root. This increases security of the container.
RUN groupadd -r user && \
useradd -r -g user -d ${HOME} -s /sbin/nologin -c "Container image user" user
RUN groupadd --system user && \
useradd --system --gid user --home-dir ${HOME} --shell /sbin/nologin \
--comment "Container image user" user

# Setup application install directory.
RUN mkdir ${APP_HOME}
# Create writable directories with the correct ownership before copying application files.
# A recursive chown after COPY would duplicate those files in a new container layer.
RUN install -d -o user -g user ${HOME} ${APP_HOME}

# If you use Docker Compose volumes, you might need to create the directories in the image,
# otherwise when Docker Compose creates them they are owned by the root user and are inaccessible
Expand All @@ -88,10 +87,7 @@ COPY --from=python_builder ${UV_PROJECT_ENVIRONMENT} ${UV_PROJECT_ENVIRONMENT}
ENV PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"

# For non-package applications, COPY source files here rather than in the --no-editable step
# in the python_builder stage.

# Give access to the entire home folder to the new user so that files and folders can be written
# there. Some packages such as matplotlib, want to write to the home folder.
RUN chown -R user:user ${HOME}
# in the python_builder stage. Set ownership during COPY to avoid a later chown layer.
# COPY --chown=user:user src src

ENTRYPOINT ["fact"]
Loading