gmao/Dockerfile

# syntax=docker/dockerfile:1

# Etape 1 : builder pour installer les dependances compilees
FROM python:3.13-slim AS builder

WORKDIR /build

# Outils de compilation temporaires + gosu
RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    gcc \
    libffi-dev \
    libssl-dev \
    gosu \
    tini \
    procps \
    psmisc \
    && rm -rf /var/lib/apt/lists/*

# Copier requirements et installer en local (non-root)
COPY requirements.txt /build/requirements.txt
RUN pip install --no-cache-dir --user -r /build/requirements.txt supervisor

# Etape 2 : image finale legere
FROM python:3.13-slim

ARG GMAO_VERSION=0.1.0-dev.1
ARG GIT_VERSION=unknown

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/home/gmao/.local/bin:/usr/local/bin:$PATH \
    TZ=Europe/Paris \
    GMAO_VERSION=${GMAO_VERSION} \
    GMAO_GUNICORN_FLAGS=--preload

LABEL org.opencontainers.image.title="GMAO College" \
      org.opencontainers.image.version="${GMAO_VERSION}" \
      org.opencontainers.image.revision="${GIT_VERSION}" \
      org.opencontainers.image.source="GMAO"

WORKDIR /app

# Creer utilisateur non-root
RUN groupadd --gid 1000 gmao && \
    useradd --uid 1000 --gid gmao --home-dir /home/gmao --create-home gmao && \
    apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    procps \
    psmisc \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copier les dependances depuis le builder
COPY --from=builder --chown=1000:1000 /root/.local /home/gmao/.local

# Copier gosu et tini
COPY --from=builder --chown=root:root /usr/sbin/gosu /usr/local/bin/gosu
COPY --from=builder --chown=root:root /usr/bin/tini /usr/local/bin/tini

# Copier la configuration supervisord
COPY docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY docker/entrypoint.sh /app/entrypoint.sh
COPY docker/run_watchdog.sh /app/run_watchdog.sh

# Code applicatif fige dans l'image de production
COPY --chown=1000:1000 app_new /app/app_new
COPY --chown=1000:1000 migrations /app/migrations
COPY --chown=1000:1000 VERSION /app/VERSION
COPY --chown=1000:1000 wsgi.py run_app_new.py /app/
COPY --chown=1000:1000 gmao_watchdog.py ent_watchdog.py pronote_watchdog.py watchdog_dnd.py /app/
COPY --chown=1000:1000 watchdog_gate.py /app/watchdog_gate.py
COPY --chown=1000:1000 docker/backup.py docker/backup_loop.py /app/

# Tracabilite du build (surchargeable avec --build-arg GIT_VERSION=...)
RUN printf '%s\n' "$GIT_VERSION" > /app/.git-version && chmod 644 /app/.git-version

# Donner les permissions
RUN chmod +x /app/entrypoint.sh /app/run_watchdog.sh \
    && mkdir -p /app/data/cache /app/app_new/uploads /app/app_new/instance /var/log/supervisor /run/supervisor \
    && chown -R gmao:gmao /app /var/log/supervisor /run/supervisor /etc/supervisor/conf.d \
    && chmod 644 /etc/supervisor/conf.d/supervisord.conf

# Point d'entree et commande par defaut
ENTRYPOINT ["/usr/local/bin/tini", "--", "/app/entrypoint.sh"]
CMD ["/home/gmao/.local/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]