Add container support - #1386
Draft
norkans7 wants to merge 1 commit into
Draft
Conversation
A multi-stage Dockerfile builds one image for every process type: python dependencies via uv, the less compiler run under bun for the static build, and assets collected and offline-compressed at build time so the runtime stage needs no node. The image runs as a non-root user and defaults to the gunicorn web process, with workers and the beat scheduler run from the same image by overriding the command. A new settings flavor takes all deployment configuration from environment variables - secret key, database and broker URLs, hostnames, email, optional object storage, and security toggles - so one image serves any install. Beat runs as its own process since the worker's embedded beat fails to spawn on this celery/python combination; RedBeat's lock makes beat replicas safe. A compose file runs the full stack locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds everything needed to run the application as a container — the deployment path the resumable-tasks work (#1374–#1384) was building toward.
Dockerfile: python dependencies installed with uv from the lockfile; the less compiler runs under bun (a drop-in node runtime) only in the build stage, where static assets are collected and offline-compressed — the runtime stage is a slim python image with just libpq added, running as a non-root user. One image serves every process type: the default command is the gunicorn web process; workers (celery -A ureport worker -Q <queue>) and the scheduler (celery -A ureport beat) run from the same image with a different command.ureport/settings.py.docker: a settings flavor (symlinked into place at image build) that takes all deployment configuration from environment variables — secret key (required, no fallback),DATABASE_URL, broker location, hostnames, email, optional S3-compatible media storage, and aDJANGO_SECUREtoggle for TLS-terminating deployments — so a single image serves any install. Static assets bake into the image with offline compression, matching the production settings' approach.docker-compose.yml: a local stack (postgres, valkey, web, worker, beat) for development and demos, with the published port configurable..dockerignore: keeps developer-local files — notably a personalureport/settings.py— out of the image.Verified end to end: image builds, migrations apply in-container, the web process serves with baked compressed assets, the worker consumes all three queues, and the beat service holds the RedBeat lock with a live schedule in redis.
One finding from verification worth separate attention: the worker's embedded beat (
-B) fails to spawn its child process entirely on celery 5.5.3 + Python 3.14 (no scheduler starts, no schedule file, no redbeat keys, silently). Container deployments here therefore run beat as its own process — which RedBeat's lock makes safe to replicate — but any non-container deployment relying on-Bembedding on this python version should verify its beat is actually running.