services/trips/Dockerfile

FROM python:3.12-slim
WORKDIR /app
ENV PYTHONUNBUFFERED=1
RUN pip install --no-cache-dir PyPDF2 bcrypt
RUN adduser --disabled-password --no-create-home appuser
RUN mkdir -p /app/data/images && chown -R appuser /app/data
COPY --chown=appuser server.py .
EXPOSE 8087
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8087/api/health', timeout=3)" || exit 1
USER appuser
CMD ["python3", "server.py"]
Initial commit: Second Brain Platform Complete platform with unified design system and real API integration. Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings Infrastructure: SvelteKit + Python gateway + Docker Compose 2026-03-28 23:20:40 -05:00			`FROM python:3.12-slim`
			`WORKDIR /app`
			`ENV PYTHONUNBUFFERED=1`
fix(trips): enforce password protection on shared trips (#3) - handle_share_api now checks X-Share-Password header against bcrypt hash before returning trip data. Returns 401 with {protected: true} if password required but not provided/incorrect - share_password now stored as bcrypt hash, not plaintext - All plaintext password logging removed from handle_share_verify - handle_share_verify uses bcrypt.checkpw instead of string equality - Migration invalidates existing plaintext share passwords (< 50 chars) - Removed dead hash_password function (used hashlib.sha256) - Added bcrypt to trips Dockerfile Closes #3 2026-03-29 08:50:45 -05:00			`RUN pip install --no-cache-dir PyPDF2 bcrypt`
fix: deployment hardening — non-root containers and health checks (#10) - Gateway, Trips, Fitness Dockerfiles: run as non-root (appuser) - Added HEALTHCHECK to gateway, trips, fitness - Used --chown=appuser on COPY for correct file permissions - Created data dirs with proper ownership before USER switch - Trips Dockerfile no longer copies whole context (only server.py) Partial fix for #10 — Node services (inventory, budget, frontend) not yet hardened. 2026-03-29 09:18:42 -05:00			`RUN adduser --disabled-password --no-create-home appuser`
			`RUN mkdir -p /app/data/images && chown -R appuser /app/data`
			`COPY --chown=appuser server.py .`
			`EXPOSE 8087`
			`HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python3 -c "import urllib.request; urllib.request.urlopen('http://localhost:8087/api/health', timeout=3)" \|\| exit 1`
			`USER appuser`
Initial commit: Second Brain Platform Complete platform with unified design system and real API integration. Apps: Dashboard, Fitness, Budget, Inventory, Trips, Reader, Media, Settings Infrastructure: SvelteKit + Python gateway + Docker Compose 2026-03-28 23:20:40 -05:00			`CMD ["python3", "server.py"]`