Etappe 6: Sicherheit

- docker-compose.yml mit read_only: true, tmpfs, healthchecks
- API- und Worker-Dockerfiles mit minimalem Image
- requirements.txt für Python-Abhängigkeiten

docker/api/Dockerfile

@@ -3,21 +3,12 @@ FROM python:3.12-slim
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
+    gcc \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir \
-    fastapi==0.115.0 \
-    uvicorn==0.30.0 \
-    psycopg2-binary==2.9.9 \
-    pydantic==2.9.0 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
+COPY docker/api/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY main.py .
-
-EXPOSE 8000
+COPY docker/api/ .
 
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

docker/api/requirements.txt

@@ -1,5 +1,13 @@
 fastapi==0.115.0
-uvicorn==0.30.0
+uvicorn==0.32.0
+sqlalchemy==2.0.32
 psycopg2-binary==2.9.9
+celery==5.4.0
+redis==5.0.4
+requests==2.32.3
 pydantic==2.9.0
-python-dotenv==1.0.1
+pydantic-settings==2.5.2
+passlib==1.7.4
+PyJWT==2.9.0
+python-multipart==0.0.9
+aiofiles==24.1.0

docker/worker/Dockerfile

@@ -3,23 +3,13 @@ FROM python:3.12-slim
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    abcde \
-    flac \
-    ffmpeg \
-    handbrake-cli \
+    gcc \
+    makepkg \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir \
-    celery==5.4.0 \
-    redis==5.0.7 \
-    psycopg2-binary==2.9.9 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
+COPY docker/worker/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
-
-CMD ["celery", "-A", "celery_app", "worker", "--loglevel=info", "--pool=solo"]
+COPY docker/worker/ .
 
+CMD ["celery", "-A", "celery_app", "worker", "--loglevel=info"]

docker/worker/requirements.txt

@@ -1,4 +1,5 @@
 celery==5.4.0
-redis==5.0.7
+redis==5.0.4
+requests==2.32.3
+sqlalchemy==2.0.32
 psycopg2-binary==2.9.9
-python-dotenv==1.0.1