Dockerfile-proxy.tmpl

# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Stage 1: Extract minimal Python3 and OpenSSL packages from matching Debian 12
FROM debian:bookworm-slim AS debian-runtime-pkg

RUN apt-get update && apt-get install -y --no-install-recommends \
    python3-minimal \
    libpython3.11-minimal \
    libpython3.11-stdlib \
    openssl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Stage 2: Final Distroless Proxy Runtime
FROM _ENVOY_IMAGE_SHA_NAME

# Copy runtime binaries and shared libraries from Stage 1
COPY --from=debian-runtime-pkg /usr/bin/python3 /usr/bin/python3
COPY --from=debian-runtime-pkg /usr/bin/python3.11 /usr/bin/python3.11
COPY --from=debian-runtime-pkg /usr/bin/openssl /usr/bin/openssl
COPY --from=debian-runtime-pkg /usr/lib/python3.11 /usr/lib/python3.11
COPY --from=debian-runtime-pkg /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu
COPY --from=debian-runtime-pkg /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf
COPY --from=debian-runtime-pkg /usr/lib/ssl /usr/lib/ssl

ENV PATH /bin:/usr/bin:$PATH

ADD docker/generic/* /apiproxy/
ADD bin/bootstrap /bin/
ADD bin/configmanager /bin/

# Distroless provides the standard nonroot user (UID 65532)
USER nonroot

ENTRYPOINT ["/usr/bin/python3", "/apiproxy/start_proxy.py"]