Etappe 6: Sicherheit

- docker-compose.yml mit read_only: true, tmpfs, healthchecks
- API- und Worker-Dockerfiles mit minimalem Image
- requirements.txt für Python-Abhängigkeiten

docker/api/Dockerfile

@@ -3,21 +3,12 @@ FROM python:3.12-slim
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
+    gcc \
     && rm -rf /var/lib/apt/lists/*
 
-RUN pip install --no-cache-dir \
-    fastapi==0.115.0 \
-    uvicorn==0.30.0 \
-    psycopg2-binary==2.9.9 \
-    pydantic==2.9.0 \
-    python-dotenv==1.0.1
-
-COPY requirements.txt .
+COPY docker/api/requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY main.py .
-
-EXPOSE 8000
+COPY docker/api/ .
 
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]