feat(docker): optimize multi-stage build using pre-built wheelhouse #350
Conversation
WalkthroughThe changes restructure the Dockerfile to implement a multi-stage build process, separating build and runtime environments. Dependency installation is optimized by prebuilding wheels during the build stage and installing them in the runtime stage from local files, with pip configured to avoid remote index access. Only essential application files are copied into the runtime image, and a non-root user is created for security. The README is updated to include a new Docker section with instructions for building and running the application in a container. No changes were made to exported or public entities. Changes
Possibly related issues
Possibly related PRs
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #350 +/- ##
=======================================
Coverage 89.18% 89.18%
=======================================
Files 2 2
Lines 111 111
=======================================
Hits 99 99
Misses 12 12
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
README.md (1)
44-58: Add Docker usage instructions—consider style consistency.
The "## Docker" section clearly explains how to build and run the container. For uniformity with prior sections (which useconsolefences), you might switch the Docker command blocks frombashtoconsole. This is a small cosmetic tweak to align formatting across the README.Dockerfile (4)
7-10: Pin apt package versions for reproducibility.
Currentlybuild-essentialandgccare installed without version pins, which can lead to unrepeatable builds over time. Consider specifying exact versions or using build-time arguments, for example:-RUN apt-get update && apt-get install -y --no-install-recommends \ - build-essential gcc && \ - rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get install -y --no-install-recommends \ + build-essential=<version> gcc=<version> && \ + rm -rf /var/lib/apt/lists/*🧰 Tools
🪛 GitHub Check: Codacy Static Code Analysis
[warning] 8-8: Dockerfile#L8
Pin versions in apt get install. Instead ofapt-get install <package>useapt-get install <package>=<version>🪛 GitHub Check: Codeac Code Quality
[warning] 8-8: DL3008
Pin versions in apt get install. Instead ofapt-get install <package>useapt-get install <package>=<version>
16-18: Scope down build context to speed up cache hits.
Copying the entire repo (COPY . .) in the build stage may invalidate cache unnecessarily. If you don’t need full sources to produce wheels, consider copying only the relevant assets or code paths:-COPY . . +# Optional: only copy what’s needed for build outputs +COPY src/ /app/src/ +COPY assets/ /app/assets/
29-30: Cleanup wheelhouse post-install to reduce image size.
After installing from/app/wheelhouse, the directory remains and inflates the image. You can remove it in the sameRUNlayer:-RUN pip install --no-cache-dir --no-index --find-links /app/wheelhouse -r requirements.txt +RUN pip install --no-cache-dir --no-index --find-links /app/wheelhouse -r requirements.txt \ + && rm -rf /app/wheelhouse
45-52: Consider adding a HEALTHCHECK and labels.
To enhance operability and observability, you could define aHEALTHCHECKfor a readiness probe and add metadata labels:+HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost:9000/health || exit 1 +LABEL maintainer="Your Name <you@example.com>" version="1.0"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
Dockerfile(1 hunks)README.md(1 hunks)
🧰 Additional context used
🪛 GitHub Check: Codacy Static Code Analysis
Dockerfile
[warning] 8-8: Dockerfile#L8
Pin versions in apt get install. Instead of apt-get install <package> use apt-get install <package>=<version>
🪛 GitHub Check: Codeac Code Quality
Dockerfile
[warning] 8-8: DL3008
Pin versions in apt get install. Instead of apt-get install <package> use apt-get install <package>=<version>
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Codacy Static Code Analysis
🔇 Additional comments (7)
README.md (1)
36-42: Clear addition of the Docs section.
The new "## Docs" section concisely directs users to the FastAPI interactive documentation, following the established "Install" and "Start" sections. Nicely done.Dockerfile (6)
1-5: Verify no unintended indentation in Dockerfile instructions.
Ensure thatFROMandWORKDIRdirectives start at column 0—leading spaces before Docker keywords will cause build failures.
12-15: Efficient dependency wheel caching.
Building wheels up front withpip wheelisolates build dependencies from the runtime image and leverages layer caching. This aligns well with multi-stage best practices.
19-23: Stage separation is clear and correct.
The split betweenAS buildandAS runtime, each with its ownWORKDIR, follows Docker multi-stage conventions and keeps the runtime image lean.
25-28: Selective wheelhouse copying.
Copying onlyrequirements.txtand the built wheels from the build stage ensures the runtime image doesn’t inherit unnecessary files. Well done.
32-38: Verify coverage of runtime source files.
The listedCOPYdirectives include key app packages; make sure this list aligns with your actual project structure (e.g., anyutils/,config/, or other folders). Missing paths here could lead to runtime errors.
40-43: Non-root user hardening is well-implemented.
Adding afastapiuser and changing ownership of/appsignificantly improves container security. Great use of least-privilege.
This change is
Summary by CodeRabbit
Documentation
Chores