mirror of
https://github.com/OpenHands/OpenHands.git
synced 2026-03-22 13:47:19 +08:00
90d2681e34
Strip git-based openhands SDK dependencies from the exported requirements.txt in the enterprise Dockerfile. These packages are already installed via the base app image and cannot have their hashes verified by pip when using git branch references. Co-authored-by: openhands <openhands@all-hands.dev>
52 lines
2.0 KiB
Docker
52 lines
2.0 KiB
Docker
ARG OPENHANDS_VERSION=latest
|
|
ARG BASE="ghcr.io/openhands/openhands"
|
|
FROM ${BASE}:${OPENHANDS_VERSION}
|
|
|
|
# Datadog labels
|
|
LABEL com.datadoghq.tags.service="deploy"
|
|
LABEL com.datadoghq.tags.env="${DD_ENV}"
|
|
|
|
# Install Node.js v20+ and npm (which includes npx)
|
|
# Apply security updates to fix CVEs
|
|
RUN apt-get update && \
|
|
apt-get install -y curl && \
|
|
curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
|
|
apt-get install -y nodejs && \
|
|
apt-get install -y jq gettext && \
|
|
# Apply security updates for packages with available fixes
|
|
apt-get upgrade -y \
|
|
libc-bin \
|
|
libc6 \
|
|
libgnutls30 \
|
|
libsqlite3-0 \
|
|
perl-base && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install poetry and export before importing current code.
|
|
RUN /app/.venv/bin/pip install poetry poetry-plugin-export
|
|
|
|
# Install Python dependencies from poetry.lock for reproducible builds
|
|
# Copy lock files first for better Docker layer caching
|
|
COPY --chown=openhands:openhands enterprise/pyproject.toml enterprise/poetry.lock /tmp/enterprise/
|
|
RUN cd /tmp/enterprise && \
|
|
# Export only main dependencies with hashes for supply chain security
|
|
/app/.venv/bin/poetry export --only main -o requirements.txt && \
|
|
# Remove the local path dependency (openhands-ai is already in base image)
|
|
# and git-based SDK dependencies (already installed via the base app image)
|
|
sed -i '/^-e /d; /openhands-ai/d; /^openhands-.*@ git+/d' requirements.txt && \
|
|
# Install pinned dependencies from lock file
|
|
/app/.venv/bin/pip install -r requirements.txt && \
|
|
# Cleanup - return to /app before removing /tmp/enterprise
|
|
cd /app && \
|
|
rm -rf /tmp/enterprise && \
|
|
/app/.venv/bin/pip uninstall -y poetry poetry-plugin-export
|
|
|
|
WORKDIR /app
|
|
COPY --chown=openhands:openhands --chmod=770 enterprise .
|
|
|
|
USER openhands
|
|
|
|
# Command will be overridden by Kubernetes deployment template
|
|
CMD ["uvicorn", "saas_server:app", "--host", "0.0.0.0", "--port", "3000"]
|