Skip to content

docker: fix the cache directory, keep the code read-only and install only the vCenter bindings #573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
semx wants to merge 2 commits into
base: development
Choose a base branch
from
Open

docker: fix the cache directory, keep the code read-only and install only the vCenter bindings #573

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a2c1e8c
docker: install only the vCenter bindings instead of all of vcf-sdk
semx Sep 30, 2026
7ae0b07
docker: keep the code read-only and give the cache a writable directory
semx Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,10 @@ COPY requirements.txt .
ARG VENV=/opt/netbox-sync/venv

# Install dependencies
RUN apt-get update && \
rm -rf /var/lib/apt/lists/* && \
python3 -m venv $VENV && \
RUN python3 -m venv $VENV && \
$VENV/bin/python3 -m pip install --upgrade pip && \
$VENV/bin/pip install -r requirements.txt && \
$VENV/bin/pip install --upgrade vcf-sdk && \
$VENV/bin/pip install vmware-vcenter==9.1.1.0 && \
find $VENV -type d -name "__pycache__" -print0 | xargs -0 -n1 rm -rf

FROM python:3.14-slim AS netbox-sync
Expand All @@ -25,11 +23,14 @@ RUN groupadd --gid 1000 netbox-sync && \
useradd --uid 1000 --gid netbox-sync --shell /bin/sh \
--no-create-home --system netbox-sync

USER netbox-sync

# Prepare the application
# Prepare the application: the code belongs to root and is read-only for the
# service user; only the cache directory is writable (group 0 as well, so an
# arbitrary uid in group 0 can use it)
WORKDIR /app
COPY --chown=netbox-sync:netbox-sync . .
COPY . .
RUN mkdir -p /app/cache && chown netbox-sync:0 /app/cache && chmod 0770 /app/cache

USER netbox-sync

# Use virtual env packages and allow timezone setup
ENV PATH=$VENV/bin:$PATH
Expand Down
Loading