frappe_docker/images/layered/Containerfile
ismail 097dcc52a1 feat(security): add dynamic resolution for FRAPPE_PATH in Containerfile
adds a dynamic resolution for folks that are using a private repo for the frappe app, and are using tokens to authenticate

Signed-off-by: ismail <38789073+ismxilxrif@users.noreply.github.com>
2026-04-24 04:36:06 +00:00

58 lines
1.7 KiB
Docker

ARG FRAPPE_BRANCH=version-16
ARG FRAPPE_BUILD=${FRAPPE_BRANCH}
ARG FRAPPE_IMAGE_PREFIX=frappe
FROM ${FRAPPE_IMAGE_PREFIX}/build:${FRAPPE_BUILD} AS builder
ARG FRAPPE_PATH=https://github.com/frappe/frappe
USER frappe
RUN --mount=type=secret,id=apps_json,target=/opt/frappe/apps.json,uid=1000,gid=1000 \
--mount=type=secret,id=frappe_path,target=/tmp/frappe_path,uid=1000,gid=1000 \
export APP_INSTALL_ARGS="" && \
if [ -f /tmp/frappe_path ] && [ -s /tmp/frappe_path ]; then \
RESOLVED_PATH=$(cat /tmp/frappe_path); \
else \
RESOLVED_PATH=${FRAPPE_PATH}; \
fi && \
if [ -f /opt/frappe/apps.json ] && [ -s /opt/frappe/apps.json ]; then \
export APP_INSTALL_ARGS="--apps_path=/opt/frappe/apps.json"; \
fi && \
bench init ${APP_INSTALL_ARGS} \
--frappe-branch=${FRAPPE_BRANCH} \
--frappe-path=${RESOLVED_PATH} \
--no-procfile \
--no-backups \
--skip-redis-config-generation \
--verbose \
/home/frappe/frappe-bench && \
cd /home/frappe/frappe-bench && \
echo "{}" > sites/common_site_config.json && \
find apps -mindepth 1 -path "*/.git" | xargs rm -fr
FROM ${FRAPPE_IMAGE_PREFIX}/base:${FRAPPE_BUILD} AS backend
USER frappe
COPY --from=builder --chown=frappe:frappe /home/frappe/frappe-bench /home/frappe/frappe-bench
WORKDIR /home/frappe/frappe-bench
VOLUME [ \
"/home/frappe/frappe-bench/sites", \
"/home/frappe/frappe-bench/logs" \
]
CMD [ \
"/home/frappe/frappe-bench/env/bin/gunicorn", \
"--chdir=/home/frappe/frappe-bench/sites", \
"--bind=0.0.0.0:8000", \
"--threads=4", \
"--workers=2", \
"--worker-class=gthread", \
"--worker-tmp-dir=/dev/shm", \
"--timeout=120", \
"--preload", \
"frappe.app:application" \
]