services/fitness/Dockerfile.backend

FROM python:3.12-slim
WORKDIR /app
RUN pip install --no-cache-dir bcrypt
RUN adduser --disabled-password --no-create-home appuser
RUN mkdir -p /app/data/images && chown -R appuser /app/data
COPY --chown=appuser server.py .
EXPOSE 8095
ENV PYTHONUNBUFFERED=1
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8095/api/health', timeout=3)" || exit 1
USER appuser
CMD ["python3", "server.py"]
Initial commit: Second Brain Platform Complete platform with unified design system and real API integration. Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings Infrastructure: SvelteKit + Python gateway + Docker Compose 2026-03-28 23:20:40 -05:00			`FROM python:3.12-slim`
			`WORKDIR /app`
fix: deployment hardening — non-root containers and health checks (#10) - Gateway, Trips, Fitness Dockerfiles: run as non-root (appuser) - Added HEALTHCHECK to gateway, trips, fitness - Used --chown=appuser on COPY for correct file permissions - Created data dirs with proper ownership before USER switch - Trips Dockerfile no longer copies whole context (only server.py) Partial fix for #10 — Node services (inventory, budget, frontend) not yet hardened. 2026-03-29 09:18:42 -05:00			`RUN pip install --no-cache-dir bcrypt`
			`RUN adduser --disabled-password --no-create-home appuser`
			`RUN mkdir -p /app/data/images && chown -R appuser /app/data`
			`COPY --chown=appuser server.py .`
Initial commit: Second Brain Platform Complete platform with unified design system and real API integration. Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings Infrastructure: SvelteKit + Python gateway + Docker Compose 2026-03-28 23:20:40 -05:00			`EXPOSE 8095`
fix: security hardening across platform - Disable open /api/auth/register endpoint (gateway) - Require gateway session auth on Immich and Karakeep hooks proxies - Replace SHA-256 with bcrypt in fitness service (auth + seed) - Remove hardcoded Telegram user IDs from fitness seed - Add Secure flag to session cookie - Add domain allowlist and content-type validation to image proxy - Strengthen .gitignore (env variants, runtime data, test artifacts) 2026-03-29 08:25:50 -05:00			`ENV PYTHONUNBUFFERED=1`
fix: deployment hardening — non-root containers and health checks (#10) - Gateway, Trips, Fitness Dockerfiles: run as non-root (appuser) - Added HEALTHCHECK to gateway, trips, fitness - Used --chown=appuser on COPY for correct file permissions - Created data dirs with proper ownership before USER switch - Trips Dockerfile no longer copies whole context (only server.py) Partial fix for #10 — Node services (inventory, budget, frontend) not yet hardened. 2026-03-29 09:18:42 -05:00			`HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8095/api/health', timeout=3)" \|\| exit 1`
			`USER appuser`
Initial commit: Second Brain Platform Complete platform with unified design system and real API integration. Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings Infrastructure: SvelteKit + Python gateway + Docker Compose 2026-03-28 23:20:40 -05:00			`CMD ["python3", "server.py"]`