Make frontend image rootless

README.md

@@ -61,7 +61,7 @@ If your network imposes you to use a custom certicifate (error "SSL" at build),
 ### The website sends an error
 Try to find error log
 * In terminal, run `docker logs basegun-backend`
-* If you cannot access terminal or don't see anything, go to `localhost:5000/logs` or `preprod.basegun.fr/logs` to see latest logs.
+* If you cannot access terminal or don't see anything, go to `localhost:8000/logs` or `preprod.basegun.fr/logs` to see latest logs.
 
 => Error "missing model": Download model from the url specified in the [backend Dockerfile](https://github.com/datalab-mi/Basegun/blob/develop/backend/Dockerfile).
 

backend/Dockerfile

@@ -45,13 +45,13 @@ RUN mkdir -p src/weights \
 # launch website
 FROM base as dev
 RUN pip --default-timeout=300 install --no-cache-dir -r requirements/dev.txt
-CMD ["uvicorn", "src.main:app", "--reload", "--host", "0.0.0.0", "--port", "5000"]
+CMD ["uvicorn", "src.main:app", "--reload", "--host", "0.0.0.0", "--port", "8000"]
 
 FROM base as test
 RUN pip install -r requirements/dev.txt && pip install requests && rm -r /root/.cache
 COPY tests/ tests/
-CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "5000"]
+CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000"]
 
 FROM base as prod
 RUN pip install --no-cache-dir -r requirements/prod.txt
-CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "5000"]
+CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000"]

backend/README.md

@@ -20,12 +20,12 @@ If you are in a network blocked with proxy, remember to add arg `--build_arg htt
 
 ### Without Docker
 ```bash
-uvicorn src.main:app --reload --host 0.0.0.0 --port 5000
+uvicorn src.main:app --reload --host 0.0.0.0 --port 8000
 ```
 
 ### With Docker
 ```bash
-docker run --rm -d -p 5000:5000 --name basegun_back -e VERSION=1.2 basegun-back:dev
+docker run --rm -d -p 8000:8000 --name basegun_back -e VERSION=1.2 basegun-back:dev
 ```
 Remember afterwards to stop container `docker stop basegun_back`
 

docker-compose-dev.yml

@@ -13,7 +13,7 @@ services:
     container_name: basegun-backend
     user: appuser
     environment:
-      - PATH_LOGS=/app/logs
+      - PATH_LOGS=/tmp/logs
       - OS_USERNAME
       - OS_PASSWORD
       - OS_PROJECT_NAME
@@ -26,11 +26,11 @@ services:
       - REQUESTS_CA_BUNDLE=$CACERT_LOCATION
     image: basegun-backend:${TAG:-2.0}-dev
     ports:
-      - 5000:5000
+      - 8000:8000
     volumes:
       - $PWD/backend/src:/app/src
       - $PWD/backend/tests:/app/tests
-      - $PWD/backend/logs:/app/logs
+      - $PWD/backend/logs:/tmp/logs
       - /app/src/weights
 
   frontend:

docker-compose-prod.yml

@@ -10,14 +10,14 @@ services:
       target: ${BUILD_TARGET:-prod}
     container_name: basegun-backend
     environment:
-      - PATH_LOGS=/app/logs
+      - PATH_LOGS=/tmp/logs
       - OS_USERNAME
       - OS_PASSWORD
       - OS_PROJECT_NAME
       - WORKSPACE=${WORKSPACE:-prod}
     image: basegun-backend:${TAG}-prod
     ports:
-      - 5000:5000
+      - 8000:8000
 
   frontend:
     build:

frontend/Dockerfile

@@ -22,7 +22,7 @@ FROM base as build
 # RUN npm ci --production
 RUN npm run build
 
-FROM nginx:1.21.4-alpine as prod
+FROM nginxinc/nginx-unprivileged:1.21.4-alpine as prod
 
 COPY nginx.conf /etc/nginx/nginx.conf
 

frontend/nginx.conf

@@ -2,6 +2,9 @@ worker_processes 4;
 
 events { worker_connections 1024; }
 
+# Directive to run nginx as non-root user
+pid        /tmp/nginx.pid;
+
 http {
     server {
         listen 8080;
@@ -13,7 +16,7 @@ http {
         }
 
         location /api/ {
-            proxy_pass http://basegun-backend:5000/;
+            proxy_pass http://localhost:8000/;
             client_max_body_size 5M;
             proxy_read_timeout 1800;
             proxy_connect_timeout 1800;

frontend/vite.config.js

@@ -61,7 +61,7 @@ export default defineConfig({
     host: true,
     proxy: {
       '^/api': {
-        target: `http://${apiHost}:5000`,
+        target: `http://${apiHost}:8000`,
         changeOrigin: true,
         rewrite: (path) => path.replace(/^\/api/, '')
       }

infra/kube/helm/values.yaml

@@ -52,8 +52,8 @@ backend:
     pullPolicy: IfNotPresent
   service:
     type: ClusterIP
-    port: 5000
-    containerPort: 5000
+    port: 8000
+    containerPort: 8000
   autoscaling:
     enabled: false
     minReplicas: 1