feat: secure, small, multi-stage Dockerfile

[pfarikrispy]

• separate build into stage
• isolate base image and apt-get
• isolate the app build
• copy only the app into a secure Chainguard Python image that's updated frequently
• group stmnts for less layers
• use image tag SHAs for more (supply chain) security
• make non-root user explicit in final stage
• smaller image that's also more secure

[coveralls]

coverage: 90.591% (+1.0%) from 89.619%
when pulling 5fe0656 on pfarikrispy:multistage
into f01e5ec on chiefonboarding:master.

[GDay]

Thanks! First time hearing about chainguard, looks good. One question before I merge this.

[pfarikrispy]

Yes you are right. Latest will fetch 3.14, which is the latest and has all the security fixes. However... Chainguard gives you almost daily free builds with any new cve resolved. But you cannot pin the version. For that you need a license. Using chainguard gives you the most secure minimal base image for the binary, but you will have to make the code work with the latest python version. It's a trade off. I believe Google has a special zero-cve or secure version of python as well. I'll have to look for it. They've hardened 250 or so essential open source containers so projects can build more secure images.

…

On Wed, Nov 26, 2025, 02:12 Stan Triepels ***@***.***> wrote: ***@***.**** commented on this pull request. Thanks! First time hearing about chainguard, looks good. One question before I merge this. ------------------------------ In back/Dockerfile <#596 (comment)> : > RUN pipenv install --system RUN django-admin compilemessages -CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"] +# checkov:skip=CKV_DOCKER_7: zero-CVE fresh image every build +FROM ***@***.***:136aad7020e00a98f617f3d3343cc7601b7823405eb2bc581eae5f5a8c21e8d0 Shouldn't this be 3.13 instead of latest? It looks like latest will download python 3.14? — Reply to this email directly, view it on GitHub <#596 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC622W75SH25UCSHKM7RXGD36T47ZAVCNFSM6AAAAACMZNSQTGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZTKMBXG42DONRUHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[pfarikrispy]

I found Google's distroless containers
Not sure which version, not that familiar with Bazel. Seems to use python 3.11. :(

However, from the thread there asking for other python versions, I was led to nvidia's collection of distroless containers for various version of python and dual arch builds (amd and arm!)
https://catalog.ngc.nvidia.com/orgs/nvidia/teams/distroless/containers/python?version=3.13-v3.1.1
They even have a build with a shell built-in and one without for production.

[GDay]

Thank you! This is great, except I get an error when deploying:

panic: exec: "/usr/bin/supervisord": stat /usr/bin/supervisord: no such file or directory

It looks like they also stripped supervisord from the nvidia image.

[pfarikrispy]

Ah yes, I see. supervisord must be copied into the distroless image as well.

I don't fully understand your app nor python. I'm more an engineer than a developer. Sorry. Wanted to make a smaller, more secure container image than the current one. I would like to isolate functionality into their own layers:

• supervisord
• the app

then copy the results into a distroless image with python.

[pfarikrispy]

@GDay I'm sorry but I'm having troubles redesigning the Dockerfile so that it become a secure multi-stage file because I don't understand Python building enough. I'm expecting a requirements.txt somewhere or a pyproject.toml. I do find the Pipfile but I don't know how to deal with that.

I have tried several iterations of the layers locally but each time pipenv complains with the same error:

Dockerfile:17
--------------------
  15 |     COPY ./back/ /app
  16 |     WORKDIR /app
  17 | >>> RUN pipenv install --system
  18 |     RUN django-admin compilemessages 
  19 |     
--------------------
ERROR: failed to build: failed to solve: process "/bin/sh -c pipenv install --system" did not complete successfully: exit code: 2

I'd love to help you get an improved container spec but I need some assistance with Python building.

I also tried to just use one layer to build the app and then copy artifacts into the distroless container, but it's not building the app (yet).

# syntax=docker/dockerfile:1
# python images are based off of Debian
FROM python:3.13-slim-trixie AS app
ENV PYTHONUNBUFFERED=1
USER root
RUN mkdir /var/run/supervisord && mkdir /var/log/supervisord
# trunk-ignore(hadolint/DL3008)
RUN apt-get -y update && apt-get install -y --no-install-recommends \
  gettext \
  supervisor \
  && rm -rf /var/lib/apt/lists/*
# trunk-ignore(hadolint/DL3013)
RUN python -m pip install --no-cache-dir pipenv
RUN mkdir -p /app
COPY ./back/ /app
WORKDIR /app
RUN pipenv install --system
RUN django-admin compilemessages 

# checkov:skip=CKV_DOCKER_7: zero-CVE fresh image every build
FROM nvcr.io/nvidia/distroless/python:3.13-v3.1.1
USER root
HEALTHCHECK NONE
WORKDIR /
COPY ./supervisord.conf /etc/supervisor/conf.d/supervisord.conf
COPY --from=app /var/log/supervisord /var/run/supervisord ./
COPY --from=app /usr/bin/supervisord /usr/bin/supervisord
COPY --from=app /app /app
USER 65532
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

Do you have any ideas to make that work?