Docker image refactor #229
Conversation
There was a problem hiding this comment.
Pull request overview
This PR refactors the Docker configuration and updates multiple Python dependencies. The changes improve reproducibility by pinning specific versions of the Python base image and the uv package manager, while also updating various dependencies to their latest versions.
Key changes:
- Docker base image pinned to specific version with Debian codename (python:3.14.0-slim-trixie)
- UV package manager pinned to version 0.9.17 instead of using :latest
- Multiple dependency updates including FastAPI, SQLAlchemy, Pydantic, and development tools
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| Dockerfile | Pins Python base image to 3.14.0-slim-trixie and uv to version 0.9.17 for improved reproducibility |
| pyproject.toml | Updates project version to 1.24.0 and bumps multiple dependency versions |
| uv.lock | Regenerated lock file with updated dependency versions and metadata |
Critical Issues Found: The uv.lock file contains numerous upload-time entries with dates in the future (ranging from November 2025 to December 2025). These dates are impossible as they haven't occurred yet relative to the January 2025 knowledge cutoff. This suggests the lock file may have been generated with incorrect system time or contains corrupted metadata that should be regenerated.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ca-certificates | ||
|
|
||
| COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ | ||
| COPY --from=ghcr.io/astral-sh/uv:0.9.17 /uv /uvx /bin/ |
There was a problem hiding this comment.
The COPY --from=ghcr.io/astral-sh/uv:0.9.17 /uv /uvx /bin/ line pulls and executes tooling from a third‑party container image referenced only by a mutable tag, which leaves the build and final image vulnerable if that tag is ever replaced with a malicious image. An attacker who compromises the ghcr.io/astral-sh/uv registry or the tag itself could ship a backdoored uv binary that runs during uv sync, altering dependencies or embedding malware into the application image. To harden the supply chain, reference this image by an immutable digest (or equivalent integrity-checked mechanism) rather than a mutable tag.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
No description provided.