build: migrate Docker images to Docker Hardened Images (DHI)

- Builder: dhi.io/python:3.13-dev (has apt, pip, shell)
- Runtime: dhi.io/python:3.13 (no shell, no pkg manager, nonroot user)
- Remove libGL (not needed: PIL manylinux bundles its own)
- Remove system GDAL (not needed: rasterio manylinux wheels bundle it)
- Keep libexpat (needed by rasterio's bundled GDAL at runtime)
- Use nonroot user (65532) instead of custom python (999)
- HEALTHCHECK exec form (no shell in runtime)
- Clean up debug RUN layers in Dockerfile (57→23 lines)
- Add .cursor to .dockerignore
- Update CLAUDE.md Docker structure docs

Base image: 203MB 25CVEs → 22MB 3CVEs (2L + 1 unspecified)

.dockerignore

@@ -2,6 +2,7 @@ venv/
 *.pyc
 __cache__
 .idea
+.cursor
 tmp/
 .env*
 __pycache__

CLAUDE.md

@@ -128,8 +128,12 @@ curl -d@./events/payload_point_colico.json -H 'content-type: application/json' $
 ### Docker Structure
 
 - `Dockerfile`: Main application image (uses pre-built base)
-- `dockerfiles/dockerfile-samgis-base`: Multi-stage base image with all dependencies
-- `dockerfiles/dockerfile-samgis-base-alpinelinux3.23`: Alpine Linux variant
+- `dockerfiles/dockerfile-samgis-base`: Multi-stage base image using Docker Hardened Images (`dhi.io/python:3.13`)
+  - Builder: `dhi.io/python:3.13-dev` (has `apt`, `pip`, shell)
+  - Runtime: `dhi.io/python:3.13` (no shell, no pkg manager, `nonroot` user 65532)
+  - `libexpat` copied from builder (required by rasterio's bundled GDAL)
+  - No libGL or system GDAL needed (manylinux wheels bundle everything)
+- `dockerfiles/dockerfile-samgis-base-alpinelinux3.23`: Alpine Linux variant (legacy)
 
 ### Model Files
 

Dockerfile

@@ -1,56 +1,23 @@
 FROM registry.gitlab.com/aletrn/gis-prediction:1.12.3
 
-# Include global arg in this stage of the build
 ARG WORKDIR_ROOT="/var/task"
-ENV VIRTUAL_ENV=${WORKDIR_ROOT}/.venv PATH="${WORKDIR_ROOT}/.venv/bin:$PATH"
-ENV WRITE_TMP_ON_DISK=""
-ENV VITE__STATIC_INDEX_URL="/static"
-ENV VITE__INDEX_URL="/"
-ENV HOME_USER=/home/python
+ENV VIRTUAL_ENV=${WORKDIR_ROOT}/.venv \
+    PATH="${WORKDIR_ROOT}/.venv/bin:/opt/python/bin:$PATH" \
+    WRITE_TMP_ON_DISK="" \
+    VITE__STATIC_INDEX_URL="/static" \
+    VITE__INDEX_URL="/"
 
-# Set working directory to function root directory
 WORKDIR ${WORKDIR_ROOT}
-# workaround for missing /home folder
-RUN ls -ld ${HOME_USER}
-RUN ls -lA ${HOME_USER}
 
-COPY --chown=python:python app.py ${WORKDIR_ROOT}/
-COPY --chown=python:python pyproject.toml poetry.lock README.md ${WORKDIR_ROOT}
-RUN chmod 755 ${WORKDIR_ROOT}/client_health.py
+COPY --chown=65532:65532 app.py ${WORKDIR_ROOT}/
+COPY --chown=65532:65532 pyproject.toml poetry.lock README.md ${WORKDIR_ROOT}/
 
-#RUN ls -l ${WORKDIR_ROOT}/app.py ${WORKDIR_ROOT}/client_health.py && chmod 755 ${WORKDIR_ROOT}/app.py ${WORKDIR_ROOT}/client_health.py
-# RUN . ${WORKDIR_ROOT}/.venv && which python && echo "# install samgis #" && pip install .
-RUN if [ "${WRITE_TMP_ON_DISK}" != "" ]; then mkdir {WRITE_TMP_ON_DISK}; fi
-RUN if [ "${WRITE_TMP_ON_DISK}" != "" ]; then ls -l {WRITE_TMP_ON_DISK}; fi
+# Smoke tests: verify imports and model files
+RUN ["python3", "-c", "import fastapi; import onnxruntime; import rasterio; import uvicorn; import jinja2; import geopandas"]
+RUN ["python3", "-c", "from pathlib import Path; assert Path('/var/task/sam-quantized/machine_learning_models').is_dir()"]
 
-RUN ls -l /usr/bin/which
-RUN /usr/bin/which python
-RUN python --version
-RUN pip list
-RUN echo "PATH: ${PATH}."
-RUN echo "WORKDIR_ROOT: ${WORKDIR_ROOT}."
-RUN ls -l ${WORKDIR_ROOT}
-RUN ls -ld ${WORKDIR_ROOT}
-RUN ls -l ${WORKDIR_ROOT}/
-RUN ls -l ${WORKDIR_ROOT}/sam-quantized/
-RUN ls -l ${WORKDIR_ROOT}/sam-quantized/machine_learning_models
-RUN ls -ld ${WORKDIR_ROOT}/sam-quantized/machine_learning_models
-RUN python -c "import sys; print(sys.path)"
-RUN python -c "import fastapi"
-RUN python -c "import geopandas"
-RUN python -c "import onnxruntime"
-RUN python -c "import rasterio"
-RUN python -c "import uvicorn"
-RUN python -c "import jinja2"
-RUN df -h
-RUN ls -l ${WORKDIR_ROOT}/app.py
-RUN ls -l ${WORKDIR_ROOT}/client_health.py
-RUN ls -l ${WORKDIR_ROOT}/static/
-RUN ls -l ${WORKDIR_ROOT}/static/dist
-RUN ls -l ${WORKDIR_ROOT}/static/node_modules
+USER 65532
 
-USER 999
-
-CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
-# client_health.py default server_url value is http://localhost:7860/health
-HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 CMD /var/task/client_health.py || exit 1
+CMD ["python3", "-m", "uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
+HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
+    CMD ["/opt/python/bin/python3", "/var/task/client_health.py"]

dockerfiles/dockerfile-samgis-base

@@ -1,84 +1,62 @@
 # Include global ARGs at the dockerfile top
-ARG ARCH="x86_64"
 ARG WORKDIR_ROOT="/var/task"
 ARG FASTAPI_STATIC="${WORKDIR_ROOT}/static"
-ARG PYTHONPATH="${WORKDIR_ROOT}:${PYTHONPATH}:/usr/local/lib/python3/dist-packages"
 ARG POETRY_NO_INTERACTION=1
 ARG POETRY_VIRTUALENVS_IN_PROJECT=1
 ARG POETRY_VIRTUALENVS_CREATE=1
 ARG POETRY_CACHE_DIR=/tmp/poetry_cache
-ARG HOME_USER=/home/python
 
 
-FROM python:3.13-trixie AS builder_global
+FROM dhi.io/python:3.13-dev AS builder_global
 
-ARG ARCH
 ARG WORKDIR_ROOT
-ARG PYTHONPATH
 ARG POETRY_NO_INTERACTION
 ARG POETRY_VIRTUALENVS_IN_PROJECT
 ARG POETRY_VIRTUALENVS_CREATE
 ARG POETRY_CACHE_DIR
 
-RUN echo "ARCH: $ARCH ..."
-
-RUN echo "ARG POETRY_CACHE_DIR: ${POETRY_CACHE_DIR} ..."
-RUN echo "ARG PYTHONPATH: $PYTHONPATH ..."
-RUN echo "arg dep:"
-
-RUN groupadd -g 999 python && useradd -r -u 999 -g python python
 # Set working directory to function root directory
-RUN mkdir ${WORKDIR_ROOT} && chown python:python ${WORKDIR_ROOT}
+RUN mkdir -p ${WORKDIR_ROOT}
 WORKDIR ${WORKDIR_ROOT}
-COPY --chown=python:python requirements_poetry.txt pyproject.toml poetry.lock README.md ${WORKDIR_ROOT}/
+COPY requirements_poetry.txt pyproject.toml poetry.lock README.md ${WORKDIR_ROOT}/
 
-# avoid segment-geospatial exception caused by missing libGL.so.1 library
-RUN apt update && apt install -y libgl1 python3-pip libexpat1 && apt clean
+# Install poetry and project dependencies into a venv
+RUN pip install --upgrade pip \
+    && pip install -r ${WORKDIR_ROOT}/requirements_poetry.txt
+RUN poetry config virtualenvs.path ${WORKDIR_ROOT} \
+    && poetry install --no-cache
 
-# poetry installation path is NOT within ${WORKDIR_ROOT}: not needed for runtime docker image
-RUN python -m pip install --upgrade pip \
-    && python -m pip install -r ${WORKDIR_ROOT}/requirements_poetry.txt && python -m pip list
 
-RUN which poetry && poetry --version && poetry config --list
-RUN poetry config virtualenvs.path ${WORKDIR_ROOT}
-RUN echo "# poetry config --list #" && poetry config --list
-RUN poetry install --no-cache
+FROM dhi.io/python:3.13-dev AS dir_creator
 
+ARG WORKDIR_ROOT
+# Pre-create workdir and copy libexpat (needed by rasterio's bundled GDAL at runtime)
+RUN mkdir -p ${WORKDIR_ROOT} && chown 65532:65532 ${WORKDIR_ROOT}
+RUN apt update && apt install -y --no-install-recommends libexpat1 && apt clean && rm -rf /var/lib/apt/lists/*
 
-FROM python:3.13-slim-trixie AS runtime
 
-ARG ARCH
-ARG WORKDIR_ROOT
-ARG HOME_USER
+FROM dhi.io/python:3.13 AS runtime
 
-ENV VIRTUAL_ENV=${WORKDIR_ROOT}/.venv PATH="${WORKDIR_ROOT}/.venv/bin:$PATH"
+ARG WORKDIR_ROOT
 
-# workaround for missing /home folder
-RUN mkdir -p /home
-RUN groupadd -g 999 python && useradd -r -u 999 -g python python
-RUN ls -l /home
-RUN ls -ld /home
-RUN mkdir -p ${HOME_USER} ${HOME_USER}/.config && chown python:python -R ${HOME_USER}
-RUN ls -ld ${HOME_USER}
-RUN ls -lA ${HOME_USER}
-RUN mkdir ${WORKDIR_ROOT} && chown python:python ${WORKDIR_ROOT}
+ENV VIRTUAL_ENV=${WORKDIR_ROOT}/.venv \
+    PATH="${WORKDIR_ROOT}/.venv/bin:/opt/python/bin:$PATH"
 
-RUN echo "RUNTIME: check libexpat.so*, libGL.so* before start" && ls -l /usr/lib/${ARCH}-linux-gnu/libexpat.so* /usr/lib/${ARCH}-linux-gnu/libGL.so* || echo "libraries libexpat.so*, libGL.so* not found"
-COPY --from=builder_global /usr/lib/${ARCH}-linux-gnu/libGL.so* /usr/lib/${ARCH}-linux-gnu/
-COPY --from=builder_global /lib/${ARCH}-linux-gnu/libexpat.so* /lib/${ARCH}-linux-gnu/
-RUN echo "RUNTIME: check libexpat.so*, libGL.so* after copy" && ls -l /usr/lib/${ARCH}-linux-gnu/libexpat.so* /usr/lib/${ARCH}-linux-gnu/libGL.so*
-COPY --from=builder_global ${WORKDIR_ROOT}/.venv ${WORKDIR_ROOT}/.venv
-RUN . ${WORKDIR_ROOT}/.venv && which python && pip list
+# Copy pre-created workdir with correct ownership
+COPY --from=dir_creator --chown=65532:65532 ${WORKDIR_ROOT} ${WORKDIR_ROOT}
+# Copy libexpat (required by rasterio's bundled GDAL)
+COPY --from=dir_creator /usr/lib/*-linux-gnu/libexpat.so* /usr/lib/
+WORKDIR ${WORKDIR_ROOT}
 
-COPY --chown=python:python ./app.py ./scripts/client_health.py ${WORKDIR_ROOT}/
+# Copy venv from builder and app files
+COPY --from=builder_global --chown=65532:65532 ${WORKDIR_ROOT}/.venv ${WORKDIR_ROOT}/.venv
+COPY --chown=65532:65532 ./app.py ./scripts/client_health.py ${WORKDIR_ROOT}/
 
-RUN echo "new WORKDIR_ROOT after hidden venv copy => ${WORKDIR_ROOT}"
-RUN ls -ld ${WORKDIR_ROOT}/
-RUN ls -lA ${WORKDIR_ROOT}/
+# Smoke test: verify critical imports work without libGL, libexpat, or system GDAL
+RUN ["python3", "-c", "import rasterio; import onnxruntime; import fastapi; import uvicorn"]
 
-RUN python -c "import rasterio"
 
-### conditional section
+### Frontend build (unchanged)
 FROM node:24-alpine AS node_fastapi
 
 ENV PNPM_HOME="/pnpm"
@@ -92,7 +70,6 @@ WORKDIR /appnode
 FROM node_fastapi AS node_prod_deps
 
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store; pnpm install --prod --frozen-lockfile
-# here multiple conditions concatenated to avoid failing on check
 RUN if [ ! -d /appnode/node_modules ]; then echo "no node_modules folder" && exit 1; fi
 
 
@@ -101,9 +78,6 @@ FROM node_fastapi AS node_build
 ARG VITE__MAP_DESCRIPTION
 ARG VITE__SAMGIS_SPACE
 ENV VITE__INDEX_URL="/"
-RUN echo "VITE__MAP_DESCRIPTION:" ${VITE__MAP_DESCRIPTION}
-RUN echo "VITE__SAMGIS_SPACE:" ${VITE__SAMGIS_SPACE}
-RUN echo "VITE__INDEX_URL:" ${VITE__INDEX_URL}
 
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store; pnpm install --frozen-lockfile
 RUN --mount=type=cache,id=pnpm,target=/pnpm/store; pnpm build
@@ -116,10 +90,7 @@ FROM runtime
 ARG FASTAPI_STATIC
 ARG WORKDIR_ROOT
 
-RUN mkdir ${FASTAPI_STATIC} && chown python:python ${FASTAPI_STATIC}
-
-COPY --chown=python:python ./sam-quantized ${WORKDIR_ROOT}/sam-quantized
-COPY --chown=python:python --from=node_prod_deps /appnode/node_modules* ${FASTAPI_STATIC}/node_modules
-COPY --chown=python:python --from=node_build /appnode/dist* ${FASTAPI_STATIC}/dist
-COPY --chown=python:python static/list_files.html ${FASTAPI_STATIC}/
-RUN ls -l ${FASTAPI_STATIC}/
+COPY --chown=65532:65532 ./sam-quantized ${WORKDIR_ROOT}/sam-quantized
+COPY --chown=65532:65532 --from=node_prod_deps /appnode/node_modules* ${FASTAPI_STATIC}/node_modules
+COPY --chown=65532:65532 --from=node_build /appnode/dist* ${FASTAPI_STATIC}/dist
+COPY --chown=65532:65532 static/list_files.html ${FASTAPI_STATIC}/