Dockerfile Improvements

[comrumino]

• Removed Dockerfile command to install the latest version of psycopg2 since requirements.txt specifies 2.8.6
• Reduced built docker images size by roughly 40% (135MB) by using multistage build so build deps arent distributed for runtime

[bmarsh9]

This is great @comrumino - we don't really have any tests (yet) so I will test manually.

[marcemv90]

What's the status of this PR? I think it is also a good opportunity to update the Dockerfile to run the application as an user other than root.

[Eric-TPS]

@comrumino - I like the approach towards using a slimmer image and incorporating a more restricted user for runtime is quite insightful. While implementing your Dockerfile, I encountered dependency issues, particularly after introducing the Werkzeug package. To address these, I've made some adjustments to your initial suggestion, which includes the integration of the limited user. Could you take a look at these modifications for a review?

Here are a few manual test if you have the time.

• [ ] Build and Run: Ensure the Docker image builds and runs without errors.
• [ ] Dependency Check: Verify all dependencies, including Werkzeug, are installed and working.
• [ ] User Permissions: Confirm the application runs under the restricted user with appropriate permissions.
• [ ] Functionality Test: Conduct basic functional tests to ensure the application operates correctly.
• [ ] Volume Management: Test volume mounts for data persistence and correct permissions.
• [ ] Networking: Check application accessibility on defined ports and correctness of network settings.
• [ ] Performance Monitoring: Observe for any unusual CPU or memory usage.
• [ ] Error Logging: Review logs for unnoticed errors or warnings.
• [ ] Security Scan: Perform a security scan on the Docker image for potential vulnerabilities.
• [ ] Dockerfile Review: Examine the Dockerfile for optimization opportunities and clarity in comments.
• [ ] Backward Compatibility: Ensure existing functionalities remain intact and operational.

# Use Python 3.8 slim image as the builder stage
FROM python:3.8.12-slim-buster AS builder

# Install build-time dependencies
RUN apt-get update && apt-get install -y \
    libpq-dev \
    gcc \
    libgirepository1.0-dev \
    libcairo2-dev \
    libpango1.0-dev \
    libgdk-pixbuf2.0-dev \
    libffi-dev \
    shared-mime-info \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies
COPY requirements.txt .
RUN pip install --upgrade pip setuptools wheel && \
    pip install -r requirements.txt

# Use Python 3.8 slim image for the runtime stage
FROM python:3.8.12-slim-buster AS app

# Set the working directory
WORKDIR /app

# Install runtime dependencies as root
RUN apt-get update && apt-get install -y \
    libpq5 \
    libcairo2 \
    libpango-1.0-0 \
    libpangocairo-1.0-0 \
    libgdk-pixbuf2.0-0 \
    shared-mime-info \
    && rm -rf /var/lib/apt/lists/*

# Create a non-root user and switch to it
RUN useradd -m gapps

# Create the directory for Flask sessions and set permissions
RUN mkdir -p /app/flask_session && chown -R gapps:gapps /app

USER gapps

# Copy installed Python packages from builder stage
COPY --from=builder /usr/local /usr/local/

# Copy the application source code
COPY . .

# Define the command to run the application
CMD ["/bin/bash", "run.sh"]