Merge pull request #12 from bento-platform/image-permissions

Better image permissions setup + locked dependencies update

Dockerfile

@@ -1,15 +1,15 @@
-FROM ghcr.io/bento-platform/bento_base_image:python-debian-latest
+FROM ghcr.io/bento-platform/bento_base_image:python-debian-2023.02.27
 
 # Use uvicorn (instead of hypercorn) in production since I've found
 # multiple benchmarks showing it to be faster - David L
-RUN pip install --no-cache-dir poetry==1.3.2 "uvicorn[standard]==0.20.0"
+RUN pip install --no-cache-dir "uvicorn[standard]==0.20.0"
 
 # Backwards-compatible with old BentoV2 container layout
 WORKDIR /service-registry
 
-COPY pyproject.toml pyproject.toml
-COPY poetry.toml poetry.toml
-COPY poetry.lock poetry.lock
+COPY pyproject.toml .
+COPY poetry.toml .
+COPY poetry.lock .
 
 # Install production dependencies
 # Without --no-root, we get errors related to the code not being copied in yet.
@@ -20,10 +20,12 @@ RUN poetry install --without dev --no-root
 # (Don't use .dockerignore, which allows us to have development containers too)
 COPY bento_service_registry bento_service_registry
 COPY entrypoint.bash .
+COPY run.bash .
 COPY LICENSE .
 COPY README.md .
 
 # Install the module itself, locally (similar to `pip install -e .`)
 RUN poetry install --without dev
 
-CMD [ "/bin/bash", "./entrypoint.bash" ]
+ENTRYPOINT [ "/bin/bash", "./entrypoint.bash" ]
+CMD [ "/bin/bash", "./run.bash" ]

dev.Dockerfile

@@ -1,6 +1,9 @@
-FROM ghcr.io/bento-platform/bento_base_image:python-debian-latest
+FROM ghcr.io/bento-platform/bento_base_image:python-debian-2023.02.27
 
-RUN pip install --no-cache-dir poetry==1.3.2 "uvicorn[standard]==0.20.0"
+SHELL ["/bin/bash", "-c"]
+
+RUN source /env/bin/activate && \
+    pip install --no-cache-dir "uvicorn[standard]==0.20.0"
 
 # Backwards-compatible with old BentoV2 container layout
 WORKDIR /service-registry
@@ -12,10 +15,12 @@ COPY poetry.lock .
 # Install production + development dependencies
 # Without --no-root, we get errors related to the code not being copied in yet.
 # But we don't want the code here, otherwise Docker cache doesn't work well.
-RUN poetry install --no-root
+RUN source /env/bin/activate && poetry install --no-root
 
-# Copy entrypoint in so we have something to start with, even though it'll get
+# Copy entrypoint and runner script in, so we have something to start with - even though it'll get
 # overwritten by volume mount.
-COPY entrypoint.dev.bash .
+COPY entrypoint.bash .
+COPY run.dev.bash .
 
-CMD [ "/bin/bash", "./entrypoint.dev.bash" ]
+ENTRYPOINT [ "/bin/bash", "./entrypoint.bash" ]
+CMD [ "/bin/bash", "./run.dev.bash" ]

entrypoint.bash

@@ -1,12 +1,15 @@
 #!/bin/bash
 
-if [[ -z "${INTERNAL_PORT}" ]]; then
-  # Set default internal port to 5000
-  INTERNAL_PORT=5000
+cd /service-registry || exit
+
+# Create bento_user + home
+source /create_service_user.bash
+
+# Fix permissions on /service-registry and /env
+chown -R bento_user:bento_user /service-registry
+if [[ -d /env ]]; then
+  chown -R bento_user:bento_user /env
 fi
 
-uvicorn bento_service_registry.app:application \
-  --workers 1 \
-  --loop uvloop \
-  --host 0.0.0.0 \
-  --port "${INTERNAL_PORT}"
+# Drop into bento_user from root and execute the CMD specified for the image
+exec gosu bento_user "$@"

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "bento_service_registry"
-version = "0.11.0"
+version = "0.11.1"
 description = "An implementation of GA4GH Service Registry API for the Bento platform."
 authors = ["David Lougheed <[email protected]>"]
 readme = "README.md"
@@ -27,7 +27,7 @@ bento-lib = {extras = ["quart"], version = "^5.4.0"}
 
 [tool.poetry.group.dev.dependencies]
 codecov = "^2.1.12"
-coverage = "^7.0.3"
+coverage = "^7.2.1"
 flake8 = "^6.0.0"
 pytest = "^7.2.0"
 pytest-cov = "^4.0.0"

run.bash

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+if [[ -z "${INTERNAL_PORT}" ]]; then
+  # Set default internal port to 5000
+  INTERNAL_PORT=5000
+fi
+
+uvicorn bento_service_registry.app:application \
+  --workers 1 \
+  --loop uvloop \
+  --host 0.0.0.0 \
+  --port "${INTERNAL_PORT}"