-
Notifications
You must be signed in to change notification settings - Fork 48
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add new AL2 based image and gunicorn
- Loading branch information
Showing
12 changed files
with
803 additions
and
713 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -102,7 +102,6 @@ ENV/ | |
| .mypy_cache/ | ||
|
|
||
| # jwt keys | ||
| keys | ||
| tests/resources/keys/*.pem | ||
|
|
||
| .DS_Store | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,56 +1,86 @@ | ||
| # To run: docker run --rm -d -v /path/to/fence-config.yaml:/var/www/fence/fence-config.yaml --name=fence -p 80:80 fence | ||
| # To check running container do: docker exec -it fence /bin/bash | ||
| ARG AZLINUX_BASE_VERSION=master | ||
|
|
||
| FROM quay.io/cdis/python:python3.9-buster-2.0.0 | ||
| # Base stage with python-build-base | ||
| FROM quay.io/cdis/python-build-base:${AZLINUX_BASE_VERSION} as base | ||
|
|
||
| # Comment this in, and comment out the line above, if quay is down | ||
| # FROM 707767160287.dkr.ecr.us-east-1.amazonaws.com/gen3/python-build-base:${AZLINUX_BASE_VERSION} as base | ||
|
|
||
| ENV appname=fence | ||
| ENV POETRY_NO_INTERACTION=1 \ | ||
| POETRY_VIRTUALENVS_IN_PROJECT=1 \ | ||
| POETRY_VIRTUALENVS_CREATE=1 | ||
|
|
||
| WORKDIR /${appname} | ||
|
|
||
| # create gen3 user | ||
| # Create a group 'gen3' with GID 1000 and a user 'gen3' with UID 1000 | ||
| RUN groupadd -g 1000 gen3 && \ | ||
| useradd -m -s /bin/bash -u 1000 -g gen3 gen3 && \ | ||
| chown -R gen3:gen3 /$appname && \ | ||
| mkdir -p /var/www/$appname && \ | ||
| chown -R gen3:gen3 /var/www/$appname && \ | ||
| chown -R gen3:gen3 /venv | ||
|
|
||
|
|
||
| # Builder stage | ||
| FROM base as builder | ||
|
|
||
| USER gen3 | ||
|
|
||
|
|
||
| RUN python -m venv /venv | ||
|
|
||
|
|
||
| COPY poetry.lock pyproject.toml /${appname}/ | ||
|
|
||
| RUN pip install poetry && \ | ||
| poetry install -vv --only main --no-interaction | ||
|
|
||
| COPY --chown=gen3:gen3 . /$appname | ||
| COPY --chown=gen3:gen3 ./deployment/wsgi/wsgi.py /$appname/wsgi.py | ||
|
|
||
| # Run poetry again so this app itself gets installed too | ||
| RUN poetry install --without dev --no-interaction | ||
|
|
||
| RUN git config --global --add safe.directory /${appname} && COMMIT=`git rev-parse HEAD` && echo "COMMIT=\"${COMMIT}\"" > /$appname/version_data.py \ | ||
| && VERSION=`git describe --always --tags` && echo "VERSION=\"${VERSION}\"" >> /$appname/version_data.py | ||
|
|
||
| # Final stage | ||
| FROM base | ||
|
|
||
| COPY --from=builder /venv /venv | ||
| COPY --from=builder /$appname /$appname | ||
|
|
||
| # install tar | ||
| RUN yum install tar -y | ||
|
|
||
| # install nginx | ||
| RUN yum install nginx -y | ||
|
|
||
| RUN setcap 'cap_net_bind_service=+ep' /usr/sbin/nginx | ||
|
|
||
| # chown nginx directories | ||
| RUN chown -R gen3:gen3 /var/log/nginx | ||
|
|
||
| # pipe nginx logs to stdout and stderr | ||
| RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log | ||
|
|
||
| # create /var/lib/nginx/tmp/client_body to allow nginx to write to fence | ||
| RUN mkdir -p /var/lib/nginx/tmp/client_body | ||
| RUN chown -R gen3:gen3 /var/lib/nginx/ | ||
|
|
||
| # copy nginx config | ||
| COPY ./deployment/nginx/nginx.conf /etc/nginx/nginx.conf | ||
|
|
||
|
|
||
| # Switch to non-root user 'gen3' for the serving process | ||
| USER gen3 | ||
|
|
||
| RUN source /venv/bin/activate | ||
|
|
||
| ENV PYTHONUNBUFFERED=1 \ | ||
| PYTHONIOENCODING=UTF-8 | ||
|
|
||
|
|
||
| RUN pip install --upgrade pip | ||
| RUN pip install --upgrade poetry | ||
| RUN apt-get update \ | ||
| && apt-get install -y --no-install-recommends curl bash git \ | ||
| && apt-get -y install vim \ | ||
| libmcrypt4 mcrypt \ | ||
| && apt-get clean \ | ||
| && rm -rf /var/lib/apt/lists/ | ||
|
|
||
| RUN mkdir -p /var/www/$appname \ | ||
| && mkdir -p /var/www/.cache/Python-Eggs/ \ | ||
| && mkdir /run/nginx/ \ | ||
| && ln -sf /dev/stdout /var/log/nginx/access.log \ | ||
| && ln -sf /dev/stderr /var/log/nginx/error.log \ | ||
| && chown nginx -R /var/www/.cache/Python-Eggs/ \ | ||
| && chown nginx /var/www/$appname | ||
|
|
||
| # aws cli v2 - needed for storing files in s3 during usersync k8s job | ||
| RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" \ | ||
| && unzip awscliv2.zip \ | ||
| && ./aws/install \ | ||
| && /bin/rm -rf awscliv2.zip ./aws | ||
|
|
||
| WORKDIR /$appname | ||
|
|
||
| # copy ONLY poetry artifact, install the dependencies but not fence | ||
| # this will make sure than the dependencies is cached | ||
| COPY poetry.lock pyproject.toml /$appname/ | ||
| RUN poetry config virtualenvs.create false \ | ||
| && poetry install -vv --no-root --no-dev --no-interaction \ | ||
| && poetry show -v | ||
|
|
||
| # copy source code ONLY after installing dependencies | ||
| COPY . /$appname | ||
| COPY ./deployment/uwsgi/uwsgi.ini /etc/uwsgi/uwsgi.ini | ||
| COPY ./deployment/uwsgi/wsgi.py /$appname/wsgi.py | ||
| COPY clear_prometheus_multiproc /$appname/clear_prometheus_multiproc | ||
|
|
||
| # install fence | ||
| RUN poetry config virtualenvs.create false \ | ||
| && poetry install -vv --no-dev --no-interaction \ | ||
| && poetry show -v | ||
|
|
||
| RUN COMMIT=`git rev-parse HEAD` && echo "COMMIT=\"${COMMIT}\"" >$appname/version_data.py \ | ||
| && VERSION=`git describe --always --tags` && echo "VERSION=\"${VERSION}\"" >>$appname/version_data.py | ||
|
|
||
| WORKDIR /var/www/$appname | ||
|
|
||
| CMD ["sh","-c","bash /fence/dockerrun.bash && /dockerrun.sh"] | ||
| CMD ["/fence/dockerrun.bash"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| user gen3; | ||
| worker_processes auto; | ||
| error_log /var/log/nginx/error.log notice; | ||
| pid /var/lib/nginx/nginx.pid; | ||
|
|
||
| # Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. | ||
| include /usr/share/nginx/modules/*.conf; | ||
|
|
||
| events { | ||
| worker_connections 1024; | ||
| } | ||
|
|
||
| http { | ||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for"'; | ||
|
|
||
| access_log /var/log/nginx/access.log main; | ||
|
|
||
| sendfile on; | ||
| tcp_nopush on; | ||
| keepalive_timeout 65; | ||
| types_hash_max_size 4096; | ||
|
|
||
| include /etc/nginx/mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| # Load modular configuration files from the /etc/nginx/conf.d directory. | ||
| # See http://nginx.org/en/docs/ngx_core_module.html#include | ||
| # for more information. | ||
| include /etc/nginx/conf.d/*.conf; | ||
|
|
||
| server { | ||
|
|
||
| listen 80; | ||
| server_name localhost; | ||
|
|
||
| location / { | ||
| proxy_pass http://127.0.0.1:8000; | ||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| } | ||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| wsgi_app = "deployment.wsgi.wsgi:application" | ||
| bind = "0.0.0.0:8000" | ||
| workers = 4 | ||
| preload_app = True | ||
| user = "gen3" | ||
| group = "gen3" | ||
| timeout = 300 | ||
| keepalive = 2 | ||
| keepalive_timeout = 5 |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| # Need this folder for permission reasons inside the container |
Oops, something went wrong.