From bafb4f7d3583e96ecd0b9b3e0da2696da1482dce Mon Sep 17 00:00:00 2001 From: Denis Yuen Date: Thu, 24 Sep 2026 10:16:20 -0400 Subject: [PATCH] SEAB-7766 Build the Docker image on Alpine and drop pip from it Switch both stages from python:3.13-slim-bookworm to python:3.13-alpine3.24, matching the Alpine 3.24 images in dockstore-deploy, and uninstall pip from the runtime image. The image shrinks from 223 MB to 139 MB (86 MB to 53 MB compressed), and Trivy goes from 251 unfixable Debian CVEs plus 3 in pip's vendored msgpack/setuptools to none. Co-Authored-By: Claude Opus 5.5 (1M context) --- Dockerfile | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 503313b..593358e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ # limitations under the License. # ---- build ---------------------------------------------------------------- -FROM python:3.13-slim-bookworm AS builder +FROM python:3.13-alpine3.24 AS builder ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \ PIP_NO_CACHE_DIR=1 \ @@ -25,10 +25,13 @@ ENV PATH="/opt/venv/bin:${PATH}" COPY pyproject.toml README.md LICENSE ./ COPY src ./src -RUN pip install . +# pip is only needed to build the venv; its vendored copies of msgpack and +# setuptools otherwise show up as CVEs in the runtime image. +RUN pip install . \ + && pip uninstall -y pip # ---- runtime -------------------------------------------------------------- -FROM python:3.13-slim-bookworm +FROM python:3.13-alpine3.24 LABEL org.opencontainers.image.title="dockstore-mcp" \ org.opencontainers.image.description="Model Context Protocol server for Dockstore" \ @@ -37,10 +40,9 @@ LABEL org.opencontainers.image.title="dockstore-mcp" \ org.opencontainers.image.licenses="Apache-2.0" \ org.opencontainers.image.vendor="OICR and UCSC" -RUN apt-get update \ - && apt-get upgrade -y \ - && rm -rf /var/lib/apt/lists/* \ - && useradd --create-home --uid 10001 --shell /usr/sbin/nologin dockstore +RUN apk upgrade --no-cache \ + && python -m pip uninstall -y pip \ + && adduser -D -u 10001 -s /sbin/nologin dockstore COPY --from=builder /opt/venv /opt/venv