Skip to content

Commit 040831a

Browse files
shahidhkclaude
andcommitted
Switch to Ubuntu Noble base image with Python 3.13
- Use ubuntu:noble-20260113 base image instead of python:3.12-slim - Install Python 3.13 from deadsnakes PPA - Run container as non-root user for security - Remove CVE-specific patches (no longer needed with new base) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 11fa372 commit 040831a

1 file changed

Lines changed: 24 additions & 16 deletions

File tree

Dockerfile

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,26 @@
1-
FROM python:3.12-slim
1+
FROM ubuntu:noble-20260113
22

3-
RUN python -m pip install --no-cache-dir --upgrade "pip>=25.3"
4-
5-
# Install curl for healthcheck
6-
RUN apt-get update && \
7-
apt-get install -y curl git && \
8-
rm -rf /var/lib/apt/lists/*
9-
10-
# Security updates for CVE-2024-56406 (Perl), CVE-2025-7709 (SQLite)
11-
# Upgrade vulnerable system packages to their fixed versions
3+
# Install dependencies and add deadsnakes PPA for latest Python
124
RUN apt-get update && \
13-
apt-get upgrade -y \
14-
libperl5.40 \
15-
perl \
16-
perl-modules-5.40 \
17-
perl-base \
18-
libsqlite3-0 && \
5+
apt-get install -y --no-install-recommends \
6+
software-properties-common \
7+
gpg-agent && \
8+
add-apt-repository -y ppa:deadsnakes/ppa && \
9+
apt-get update && \
10+
apt-get install -y --no-install-recommends \
11+
python3.13 \
12+
python3.13-venv \
13+
curl \
14+
git && \
15+
apt-get purge -y software-properties-common gpg-agent && \
16+
apt-get autoremove -y && \
1917
apt-get clean && \
2018
rm -rf /var/lib/apt/lists/*
2119

20+
# Create python symlinks for compatibility
21+
RUN ln -sf /usr/bin/python3.13 /usr/bin/python && \
22+
ln -sf /usr/bin/python3.13 /usr/bin/python3
23+
2224
COPY /docker /scripts
2325
COPY /functions /functions
2426

@@ -28,6 +30,12 @@ RUN chmod +x /scripts/package-restore.sh /scripts/start.sh
2830
# Run the package-restore script
2931
RUN /scripts/package-restore.sh
3032

33+
# Create non-root user
34+
RUN useradd -m python && \
35+
chown -R python:python /scripts /functions
36+
37+
USER python
38+
3139
EXPOSE 8080
3240

3341
HEALTHCHECK --interval=5s --timeout=10s --start-period=1s --retries=3 \

0 commit comments

Comments
 (0)