Python distroless with poetry example

distorless.python.Dockerfile

# syntax=docker/dockerfile:1

ARG PYTHON_BUILDER_IMAGE=python:3.11
ARG GOOGLE_DISTROLESS_BASE_IMAGE=gcr.io/distroless/cc-debian12

FROM ${PYTHON_BUILDER_IMAGE} AS python-base

## ------------------------------- distroless base image ------------------------------ ##

# build from distroless C or cc:debug, because lots of Python depends on C
FROM ${GOOGLE_DISTROLESS_BASE_IMAGE} AS base

ARG CHIPSET_ARCH=x86_64-linux-gnu

## ------------------------- copy python itself from builder -------------------------- ##

# this carries more risk than installing it fully, but makes the image a lot smaller
COPY --from=python-base /usr/local/lib/ /usr/local/lib/
COPY --from=python-base /usr/local/bin/python /usr/local/bin/python
COPY --from=python-base /etc/ld.so.cache /etc/ld.so.cache

## -------------------------- add common compiled libraries --------------------------- ##

# If seeing ImportErrors, check if in the python-base already and copy as below

# required by lots of packages - e.g. six, numpy, wsgi
COPY --from=python-base /lib/${CHIPSET_ARCH}/libz.so.1 /lib/${CHIPSET_ARCH}/
# required by google-cloud/grpcio
COPY --from=python-base /usr/lib/${CHIPSET_ARCH}/libffi* /usr/lib/${CHIPSET_ARCH}/
COPY --from=python-base /lib/${CHIPSET_ARCH}/libexpat* /lib/${CHIPSET_ARCH}/
# add other required libs

## -------------------------------- non-root user setup ------------------------------- ##

COPY --from=python-base /bin/echo /bin/echo
COPY --from=python-base /bin/rm /bin/rm
COPY --from=python-base /bin/sh /bin/sh

RUN echo "python:x:1000:python" >> /etc/group
RUN echo "python:x:1001:" >> /etc/group
RUN echo "python:x:1000:1001::/home/python:" >> /etc/passwd

# quick validation that python still works whilst we have a shell
RUN python --version

RUN rm /bin/sh /bin/echo /bin/rm

## --------------------------- standardise execution env ----------------------------- ##

# default to running as non-root, uid=1000
USER python

# standardise on locale, don't generate .pyc, enable tracebacks on seg faults
ENV LANG=C.UTF-8
ENV LC_ALL=C.UTF-8
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONFAULTHANDLER=1


## --------------------------- install packages ----------------------------- ##

FROM ${PYTHON_BUILDER_IMAGE} AS pkgs

#https://github.com/GoogleContainerTools/distroless/issues/863
RUN apt-get update && \
    apt-get download \
        poppler-utils && \
    mkdir -p /dpkg/var/lib/dpkg/status.d/ && \
    for deb in *.deb; do \
        # Extract package name from the deb file
        package_name=$(dpkg-deb -I "${deb}" | awk '/^ Package: / {print $2}'); \
        echo "Processing package: ${package_name}"; \
        # Extract control information and save it
        dpkg --ctrl-tarfile "${deb}" | tar -Oxvf - ./control > /dpkg/var/lib/dpkg/status.d/"${package_name}"; \
        # Extract the deb package into /dpkg directory
        dpkg --extract "${deb}" /dpkg || exit 10; \
    done

RUN pip install poetry && \
    poetry config virtualenvs.create false

COPY poetry.lock pyproject.toml .
RUN poetry install --no-interaction --no-ansi --no-root --with main --with deploy && \
    pip uninstall -y poetry

FROM base

COPY --from=pkgs /dpkg /
COPY --from=pkgs /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages

WORKDIR /apps
ENV PYTHONPATH=/apps
COPY ./src ./src
COPY ./main.py