46 lines
1.1 KiB
Docker
46 lines
1.1 KiB
Docker
FROM python:3.12-slim AS builder
|
|
|
|
# Prevent .pyc files and enable unbuffered stdout/stderr
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
WORKDIR /app
|
|
|
|
# Install build tools in builder stage only
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends gcc libc6-dev && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install deps first — layer cache reuse on code-only changes
|
|
COPY requirements.txt .
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
pip install --no-cache-dir -r requirements.txt
|
|
|
|
# Runtime stage - clean slate
|
|
FROM python:3.12-slim
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy only installed packages from builder
|
|
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
|
|
COPY --from=builder /usr/local/bin /usr/local/bin
|
|
|
|
# Copy source
|
|
COPY main.py config.py ./
|
|
COPY modules/ modules/
|
|
|
|
# Run as non-root
|
|
RUN adduser --disabled-password --gecos "" botuser && \
|
|
mkdir -p /app/storage /app/logs && \
|
|
chown -R botuser:botuser /app
|
|
|
|
USER botuser
|
|
|
|
# Persistent volume for Pyrogram session and logs
|
|
VOLUME ["/app/storage", "/app/logs"]
|
|
|
|
CMD ["python", "main.py"]
|