feat: optimize Dockerfiles with multi-stage builds, non-root user, .dockerignore

8 files changed, 79 insertions, 11 deletions

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..8daace4
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,18 @@
+__pycache__
+*.pyc
+*.pyo
+.git
+.github
+.venv
+.env
+.env.*
+!.env.example
+tests/
+docs/
+*.md
+.ruff_cache
+.pytest_cache
+.mypy_cache
+monitoring/
+scripts/
+cli/
diff --git a/services/api/Dockerfile b/services/api/Dockerfile
index b942075..93d2b75 100644
--- a/services/api/Dockerfile
+++ b/services/api/Dockerfile
@@ -1,11 +1,18 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/api/ services/api/
 RUN pip install --no-cache-dir ./services/api
-COPY services/strategy-engine/strategies/ /app/strategies/
 COPY services/strategy-engine/ services/strategy-engine/
 RUN pip install --no-cache-dir ./services/strategy-engine
-ENV PYTHONPATH=/app
-CMD ["uvicorn", "trading_api.main:app", "--host", "0.0.0.0", "--port", "8000"]
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY services/strategy-engine/strategies/ /app/strategies/
+ENV PYTHONPATH=/app STRATEGIES_DIR=/app/strategies
+USER appuser
+CMD ["uvicorn", "trading_api.main:app", "--host", "0.0.0.0", "--port", "8000", "--timeout-graceful-shutdown", "30"]
diff --git a/services/backtester/Dockerfile b/services/backtester/Dockerfile
index 9a4f439..1108e42 100644
--- a/services/backtester/Dockerfile
+++ b/services/backtester/Dockerfile
@@ -1,10 +1,17 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/backtester/ services/backtester/
 RUN pip install --no-cache-dir ./services/backtester
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 COPY services/strategy-engine/strategies/ /app/strategies/
 ENV STRATEGIES_DIR=/app/strategies
 ENV PYTHONPATH=/app
+USER appuser
 CMD ["python", "-m", "backtester.main"]
diff --git a/services/data-collector/Dockerfile b/services/data-collector/Dockerfile
index 8cb8af4..4d154c5 100644
--- a/services/data-collector/Dockerfile
+++ b/services/data-collector/Dockerfile
@@ -1,8 +1,15 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/data-collector/ services/data-collector/
 RUN pip install --no-cache-dir ./services/data-collector
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 ENV PYTHONPATH=/app
+USER appuser
 CMD ["python", "-m", "data_collector.main"]
diff --git a/services/news-collector/Dockerfile b/services/news-collector/Dockerfile
index a8e5902..7accee2 100644
--- a/services/news-collector/Dockerfile
+++ b/services/news-collector/Dockerfile
@@ -1,9 +1,17 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/news-collector/ services/news-collector/
 RUN pip install --no-cache-dir ./services/news-collector
-RUN python -c "import nltk; nltk.download('vader_lexicon', quiet=True)"
+RUN python -c "import nltk; nltk.download('vader_lexicon', download_dir='/usr/local/nltk_data')"
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+COPY --from=builder /usr/local/nltk_data /usr/local/nltk_data
 ENV PYTHONPATH=/app
+USER appuser
 CMD ["python", "-m", "news_collector.main"]
diff --git a/services/order-executor/Dockerfile b/services/order-executor/Dockerfile
index bc8b21c..376afec 100644
--- a/services/order-executor/Dockerfile
+++ b/services/order-executor/Dockerfile
@@ -1,8 +1,15 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/order-executor/ services/order-executor/
 RUN pip install --no-cache-dir ./services/order-executor
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 ENV PYTHONPATH=/app
+USER appuser
 CMD ["python", "-m", "order_executor.main"]
diff --git a/services/portfolio-manager/Dockerfile b/services/portfolio-manager/Dockerfile
index b1a7681..0fa3f35 100644
--- a/services/portfolio-manager/Dockerfile
+++ b/services/portfolio-manager/Dockerfile
@@ -1,8 +1,15 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/portfolio-manager/ services/portfolio-manager/
 RUN pip install --no-cache-dir ./services/portfolio-manager
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 ENV PYTHONPATH=/app
+USER appuser
 CMD ["python", "-m", "portfolio_manager.main"]
diff --git a/services/strategy-engine/Dockerfile b/services/strategy-engine/Dockerfile
index de635dc..f1484e9 100644
--- a/services/strategy-engine/Dockerfile
+++ b/services/strategy-engine/Dockerfile
@@ -1,9 +1,16 @@
-FROM python:3.12-slim
+FROM python:3.12-slim AS builder
 WORKDIR /app
 COPY shared/ shared/
 RUN pip install --no-cache-dir ./shared
 COPY services/strategy-engine/ services/strategy-engine/
 RUN pip install --no-cache-dir ./services/strategy-engine
+
+FROM python:3.12-slim
+RUN useradd -r -s /bin/false appuser
+WORKDIR /app
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
 COPY services/strategy-engine/strategies/ /app/strategies/
 ENV PYTHONPATH=/app
+USER appuser
 CMD ["python", "-m", "strategy_engine.main"]