Create production docker container

[northdpole]

start with distroless
https://medium.com/@luke_perry_dev/dockerizing-with-distroless-f3b84ae10f3a

[robvanderveer]

status?

[northdpole]

Maintainer verification (2026-07-09) — FAIL

Attempted to build and run the production container per current Makefile/docs. Could not complete end-to-end verification on this host.

Commands run

# Official Makefile target (native arm64 / Colima)
make docker-prod
# => FAIL at yarn install: puppeteer chromium binary not available for arm64

# Retry with explicit amd64 platform
docker build --platform linux/amd64 -f Dockerfile -t opencre:$(git rev-parse HEAD) .
# => FAIL: no space left on device while COPY . /code (includes local .venv; .dockerignore lists venv/ but not .venv/)

# Retry excluding large local dirs via tar context
tar -cf - --exclude='.venv' --exclude='venv' --exclude='.git' --exclude='node_modules' --exclude='*.sqlite' --exclude='.neo4j' . | docker build --platform linux/amd64 -f Dockerfile -t opencre:$(git rev-parse HEAD) -
# => FAIL: no space left on device (Docker/Colima disk full)

# Fallback: published image from GHCR (see .github/workflows/publish.yml)
docker pull ghcr.io/owasp/opencre/opencre:latest
docker run --rm -p 15000:5000 ghcr.io/owasp/opencre/opencre:latest
# => FAIL: image pull incomplete — no space left on device

Current documented workflow (repo)

Step	Target / file
Build	make docker-prod → Dockerfile
Run	make docker-prod-run → docker run -it -p $(PORT):$(PORT) opencre:$(git rev-parse HEAD)
Startup	scripts/prod-docker-entrypoint.sh: flask db upgrade → python cre.py --upstream_sync → gunicorn cre:app -b :5000
Publish	.github/workflows/publish.yml tags ghcr.io/owasp/opencre/opencre:latest on version tags

Findings

1. Build fragility on arm64: production Dockerfile runs yarn install (puppeteer postinstall) without the dev Dockerfile's chromium workaround (fix: Resolve docker-dev build failures for arm64 and macOS #641 fixed dev only).
2. Build context bloat: .dockerignore excludes venv/ but not .venv/, so local virtualenvs get sent to the daemon (942MB+ context observed).
3. Could not verify upstream_sync or post-sync data — container never started here due to disk exhaustion during image pull/build.

Related commits/PRs that established the current workflow

• Cloud run support and tracing #457 — Cloud run support: Dockerfile, scripts/prod-docker-entrypoint.sh, Makefile docker targets
• Importing v3 #482 — Importing v3 (upstream sync integration)
• Add docker run information to readme #526 — Docker run documentation in README
• fix: Resolve docker-dev build failures for arm64 and macOS #641 — arm64 docker-dev fixes (prod Dockerfile not updated similarly)
• .github/workflows/publish.yml — GHCR publish on v*.*.* tags

Suggested fixes

1. Add .venv/ to .dockerignore (and consider standards_cache.sqlite already excluded).
2. Mirror fix: Resolve docker-dev build failures for arm64 and macOS #641 puppeteer/chromium handling in production Dockerfile build stage for arm64.
3. Re-test on a host with sufficient Docker disk (or prune Colima volume) to confirm upstream_sync populates data and gunicorn serves /rest/v1/root_cres.

Leaving #15 open — workflow exists in repo but local verification blocked; arm64 prod build may still be broken on Apple Silicon.

[northdpole]

Verified fixed in #971 (merge commit 7d0634e9).

Build: make docker-prod succeeds — TS/webpack errors resolved (tsconfig excludes application/frontend/www, @types/minimatch stub removed in postinstall, small React 18 typing fixes).

Runtime: after upstream_sync, curl http://127.0.0.1:5001/rest/v1/standards returned 24 standards (e.g. ETSI, ASVS, SAMM). Entrypoint now uses flask db upgrade heads and adds missing document_metadata columns before sync.

macOS note: port 5000 is often AirPlay — map -p 5001:5000.