Dockerfile.example

FROM python:3.13-alpine

WORKDIR /app

# Copy in requirements files, if needed
# These could be for Ansible Galaxy, Poetry, or a requirements.txt file
COPY ./requirements.txt ./requirements.txt
COPY ./ansible-galaxy-requirements.yaml ./ansible-galaxy-requirements.yaml

# Install required system packages
RUN apk add --update --no-cache gcc libc-dev libffi-dev openssh tini

# Install Ansible. LSO does not bring its own, so that you pick the version your playbooks and collections
# expect. Pin it here to keep image builds reproducible.
RUN pip install ansible=="14.2.0"

# Install the LSO python package, and additional requirements
RUN pip install orchestrator-lso=="5.2.0"
RUN pip install -r requirements.txt

# Install required Ansible Galaxy roles and collections
RUN ansible-galaxy install \
                   -r ansible-galaxy-requirements.yaml \
                   -p /app/gap/ansible
RUN ansible-galaxy collection install \
                   -r ansible-galaxy-requirements.yaml \
                   -p /app/gap/ansible

# Run as an unprivileged user rather than root. LSO runs playbooks and executables on request, so whatever
# its process can reach is what a request can reach: keep that as small as your deployment allows. Anything
# the service has to read at runtime, an SSH key in particular, belongs in this user's home rather than in
# /root. See compose.yaml.example.
RUN addgroup -S lso \
    && adduser -S -G lso -h /home/lso lso \
    && chown -R lso:lso /app /home/lso
USER lso

EXPOSE 8000
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["python", "-m",  "uvicorn", "lso.app:app", "--host", "0.0.0.0", "--port", "8000"]

# Using your own authentication or authorization code?
# `lso.app:app` above is already built when uvicorn imports it, so you cannot register anything on it.
# Build the app in your own module instead, and run that:
#
# COPY ./my_lso.py ./my_lso.py
# CMD ["python", "-m", "uvicorn", "my_lso:app", "--host", "0.0.0.0", "--port", "8000"]
#
# Using only the shared secret (LSO_OAUTH2_ACTIVE=true and LSO_API_KEY)? Then you need none of this.
# Keep the CMD above. See docs/security.md.