0b72e7040f
All checks were successful
CD Pipeline / deploy (push) Successful in 9m13s
從 4349db2~1 撈回 production 啟動指令。
問題：
- 4349db2 改回 `CMD ["python", "app.py"]` 用 Flask dev server 跑 production，
單進程、無 worker pool、debug 邏輯保留、效能與安全都不適合對外。
- EXPOSE 5000 與 docker-compose / k8s 實際使用 port 80 不符
(reference_docker_topology.md 確認 momo-pro-system 是 port 80)。
修法：
- CMD 改回：gunicorn --bind 0.0.0.0:80 --workers 4 --timeout 300
--access-logfile - --error-logfile - app:app
- EXPOSE 5000 → EXPOSE 80（對齊容器內實際綁定）
- requirements.txt 已含 gunicorn>=20.1，build 不需要其他改動
驗證：
- grep 確認 CMD 與 EXPOSE 已更新
- gunicorn 在 requirements.txt 中（line 不需求動）
Critic finding: HIGH-5
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
69 lines
2.0 KiB
Docker
69 lines
2.0 KiB
Docker
FROM python:3.11-slim
|
||
|
||
# 設定工作目錄
|
||
WORKDIR /app
|
||
|
||
# 安裝系統依賴 (包含 PostgreSQL 客戶端庫 + Chrome/Selenium 依賴)
|
||
# 注意：Debian Trixie 已移除 libgconf-2-4，改用 libglib2.0-0
|
||
RUN apt-get update && apt-get install -y \
|
||
gcc \
|
||
g++ \
|
||
curl \
|
||
libpq-dev \
|
||
# Chrome/Selenium 依賴
|
||
wget \
|
||
gnupg \
|
||
unzip \
|
||
libnss3 \
|
||
libglib2.0-0 \
|
||
libfontconfig1 \
|
||
libx11-xcb1 \
|
||
libasound2t64 \
|
||
libatk1.0-0 \
|
||
libatk-bridge2.0-0 \
|
||
libcups2 \
|
||
libdrm2 \
|
||
libgbm1 \
|
||
libgtk-3-0 \
|
||
libxcomposite1 \
|
||
libxdamage1 \
|
||
libxrandr2 \
|
||
xdg-utils \
|
||
fonts-liberation \
|
||
openssh-client \
|
||
libappindicator3-1 || true \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# 安裝 Chrome (使用新版 GPG 金鑰管理方式，apt-key 已被移除)
|
||
RUN mkdir -p /etc/apt/keyrings \
|
||
&& wget -q -O /etc/apt/keyrings/google-chrome.asc https://dl.google.com/linux/linux_signing_key.pub \
|
||
&& echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/google-chrome.asc] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list \
|
||
&& apt-get update \
|
||
&& apt-get install -y google-chrome-stable \
|
||
&& rm -rf /var/lib/apt/lists/*
|
||
|
||
# 複製 requirements
|
||
COPY requirements.txt .
|
||
|
||
# 安裝 Python 依賴
|
||
RUN pip install --no-cache-dir -r requirements.txt
|
||
|
||
# 複製應用程式
|
||
COPY . .
|
||
|
||
# 建立必要的目錄
|
||
RUN mkdir -p data logs backups
|
||
|
||
# 確保 components symlink 正確（根目錄頁面需要此路徑）
|
||
RUN rm -rf /app/components && ln -sf /app/templates/components /app/components
|
||
|
||
# 設定環境變數
|
||
ENV PYTHONUNBUFFERED=1
|
||
ENV FLASK_APP=app.py
|
||
|
||
# 暴露端口（容器內 app 綁 80，docker-compose / k8s 對外映射依環境而定）
|
||
EXPOSE 80
|
||
|
||
# 啟動應用（production 用 gunicorn，4 workers + 300s timeout + 啟用 access/error log）
|
||
CMD ["gunicorn", "--bind", "0.0.0.0:80", "--workers", "4", "--timeout", "300", "--access-logfile", "-", "--error-logfile", "-", "app:app"]
|