Merge pull request #39 from bento-platform/perm-dropdown

use permissions drop down for running service in image

.github/workflows/build.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Run Bento build action
-        uses: bento-platform/bento_build_action@v0.10.1
+        uses: bento-platform/bento_build_action@v0.11.0
         with:
           registry: ghcr.io
           registry-username: ${{ github.actor }}

Dockerfile

@@ -1,14 +1,17 @@
-FROM ghcr.io/bento-platform/bento_base_image:python-debian-latest
+FROM ghcr.io/bento-platform/bento_base_image:python-debian-2023.02.27
+
+# Run as root in the Dockerfile until we drop down to the service user in the entrypoint
+USER root
 
 # Use uvicorn (instead of hypercorn) in production since I've found
 # multiple benchmarks showing it to be faster - David L
-RUN pip install --no-cache-dir poetry==1.3.2 "uvicorn[standard]==0.20.0"
+RUN pip install --no-cache-dir "uvicorn[standard]==0.20.0"
 
 WORKDIR /aggregation
 
-COPY pyproject.toml pyproject.toml
-COPY poetry.toml poetry.toml
-COPY poetry.lock poetry.lock
+COPY pyproject.toml .
+COPY poetry.toml .
+COPY poetry.lock .
 
 # Install production dependencies
 # Without --no-root, we get errors related to the code not being copied in yet.
@@ -18,11 +21,12 @@ RUN poetry install --without dev --no-root
 # Manually copy only what's relevant
 # (Don't use .dockerignore, which allows us to have development containers too)
 COPY bento_aggregation_service bento_aggregation_service
-COPY LICENSE LICENSE
-COPY README.md README.md
-COPY run.py run.py
+COPY LICENSE .
+COPY README.md .
+COPY run.py .
 
 # Install the module itself, locally (similar to `pip install -e .`)
 RUN poetry install --without dev
 
-ENTRYPOINT ["python3", "run.py"]
+# Use base image entrypoint for dropping down into bento_user & running this CMD
+CMD [ "python3", "run.py" ]

dev.Dockerfile

@@ -1,6 +1,9 @@
-FROM ghcr.io/bento-platform/bento_base_image:python-debian-latest
+FROM ghcr.io/bento-platform/bento_base_image:python-debian-2023.02.27
 
-RUN pip install --no-cache-dir poetry==1.3.2 "uvicorn[standard]==0.20.0"
+# Run as root in the Dockerfile until we drop down to the service user in the entrypoint
+USER root
+
+RUN source /env/bin/activate && pip install --no-cache-dir "uvicorn[standard]==0.20.0"
 
 WORKDIR /aggregation
 
@@ -11,12 +14,14 @@ COPY poetry.lock .
 # Install production + development dependencies
 # Without --no-root, we get errors related to the code not being copied in yet.
 # But we don't want the code here, otherwise Docker cache doesn't work well.
-RUN poetry install --no-root
+RUN source /env/bin/activate && poetry install --no-root
 
 # Don't copy code in, since it gets mounted in with development mode.
-# Copy in an entrypoint so we have somewhere to start.
+# Copy in an entrypoint + runner script so we have somewhere to start.
 
-COPY entrypoint.dev.bash .
+COPY run.dev.bash .
 
 ENV CHORD_DEBUG=True
-ENTRYPOINT ["bash", "./entrypoint.dev.bash"]
+
+# Use base image entrypoint for dropping down into bento_user & running this CMD
+CMD ["bash", "./run.dev.bash"]

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "bento_aggregation_service"
-version = "0.17.1"
+version = "0.17.2"
 description = "Search result aggregation service for the Bento platform."
 authors = ["David Lougheed <[email protected]>"]
 readme = "README.md"

run.dev.bash

@@ -0,0 +1,16 @@
+#!/bin/bash
+
+cd /aggregation || exit
+
+# Set .gitconfig for development
+/set_gitconfig.bash
+
+source /env/bin/activate
+
+# Update dependencies and install module locally (similar to pip install -e: "editable mode")
+poetry install
+
+export BENTO_DEBUG=true
+export CHORD_DEBUG=true
+
+python3 ./run.py