Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: a bunch of dependency updates #544

Merged
merged 13 commits into from
Feb 11, 2021
Merged

chore: a bunch of dependency updates #544

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
9bcea6f
build(deps-dev): bump pytest-cov from 2.10.1 to 2.11.0
dependabot[bot] Jan 18, 2021
b30c4b0
build(deps): bump pyyaml from 5.3.1 to 5.4
dependabot[bot] Jan 20, 2021
1e06781
build(deps): bump gevent from 20.12.1 to 21.1.2
dependabot[bot] Jan 20, 2021
06cd609
build(deps-dev): bump pytest-cov from 2.11.0 to 2.11.1
dependabot[bot] Jan 21, 2021
3cbf212
build(deps): bump pyyaml from 5.4 to 5.4.1
dependabot[bot] Jan 21, 2021
349e533
build(deps-dev): bump pytest from 6.2.1 to 6.2.2
dependabot[bot] Jan 26, 2021
0d96c51
build(deps): bump urllib3 from 1.26.2 to 1.26.3
dependabot[bot] Jan 27, 2021
ea3ee13
build(deps-dev): bump pre-commit from 2.9.3 to 2.10.0
dependabot[bot] Jan 28, 2021
9e57e24
build(deps): bump python-gitlab from 2.5.0 to 2.6.0
dependabot[bot] Feb 1, 2021
24e7783
build(deps-dev): bump pre-commit from 2.10.0 to 2.10.1
dependabot[bot] Feb 8, 2021
ce0df32
chore: recreate pipenv lockfile
Feb 10, 2021
3557169
chore: switch to debian based python image
Feb 10, 2021
b35f005
Merge branch 'master' into dependabot-updates
ableuler Feb 11, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,11 @@
FROM python:3.7-alpine
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this change?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ableuler why are we changing the base image? Was this also a security vulnerability?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot upgraded the cryptography package which doesn't play well with the alpine based image (we'd have to add a rust compiler). After switching to the debian based python image the package is pip-installable again. But I quickly wanted to try with the -slim base image and compare sizes, should have labeled it as WIP.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pyca/cryptography#5771

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The slim image is actually smaller than the resulting alpine image with the necessary installs.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

double win 🥇

FROM python:3.7-slim

LABEL maintainer="info@datascience.ch"

RUN apk update && \
apk add --no-cache curl build-base libffi-dev openssl-dev && \
pip install --no-cache-dir --disable-pip-version-check -U pip && \
RUN pip install --no-cache-dir --disable-pip-version-check -U pip && \
pip install --no-cache-dir --disable-pip-version-check pipenv && \
addgroup -g 1000 kyaku && \
adduser -S -u 1000 -G kyaku kyaku
groupadd -g 1000 kyaku && \
useradd -u 1000 -g kyaku kyaku

# Install all packages
COPY Pipfile Pipfile.lock /renku-notebooks/
Expand Down
Loading