Week 4 · Cloud & containers · about 3 minutes
What you will be able to do
Ship the Trusted Data API in a multi-stage image so the compiler never reaches production.
The idea
A single-stage Dockerfile that installs build tools and then serves the app ships those tools forever. Attackers love that.
Use two stages. Build in a fat image. Copy only the virtualenv or binary into a slim runtime, drop to a non-root user, and set the CMD.
FROM python:3.12-slim AS builder
WORKDIR /app
COPY pyproject.toml .
RUN pip install --prefix=/install .
FROM python:3.12-slim
COPY --from=builder /install /usr/local
COPY app ./app
USER 10001
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0"]If the production layer can compile code, you shipped the wrong layer.
Key takeaways
- Compile and install in a builder stage.
- Copy only the runtime artifact into slim.
- Run as a non-root user.
Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.