9d3f8e46a0
- Add Dockerfile with MediaInfo, non-root user, slim base - Add docker-compose.yml with env_file and volume mounts - Add nginx.conf with security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) - Hide server version (server_tokens off) - Add SECURITY.md with full audit report and deployment guide - Add .dockerignore for clean builds Closes #11, #14, #21, #22
30 lines
581 B
Docker
30 lines
581 B
Docker
FROM python:3.12-slim AS base
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libmediainfo0v \
|
|
zlib1g-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
COPY . .
|
|
|
|
RUN python -m compileall src/
|
|
|
|
ARG USER=epmatcher
|
|
ARG UID=1000
|
|
ARG GID=1000
|
|
|
|
RUN groupadd -g "$GID" "$USER" && \
|
|
useradd -u "$UID" -g "$GID" -m -s /bin/bash "$USER" && \
|
|
mkdir -p /app/src/.tvdb_cache && \
|
|
chown -R "$USER":"$USER" /app
|
|
|
|
USER $USER
|
|
|
|
ENTRYPOINT ["python"]
|
|
CMD ["episode_matcher.py"]
|