PPHA-494: use chainguard hardened images

Dockerfile

@@ -1,5 +1,6 @@
-FROM node:25.2.1-alpine3.21 AS asset_builder
+FROM cgr.dev/nhs.net/node:25.2-dev AS asset_builder
 
+USER root
 WORKDIR /app
 
 COPY package.json package-lock.json rollup.config.js  ./
@@ -8,19 +9,22 @@ RUN npm ci
 RUN npm run compile
 
 
-FROM python:3.14.1-alpine3.21 AS python_base
+FROM cgr.dev/nhs.net/python:3.14-dev AS python_base
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     VIRTUAL_ENV=/app/.venv \
     PATH="/app/.venv/bin:$PATH" \
     USER=app
 
+USER root
 RUN addgroup --gid 1000 --system ${USER} \
     && adduser --uid 1000 --system ${USER} --ingroup ${USER}
 
+
 FROM python_base AS builder
 
+USER root
 WORKDIR /app
 
 ENV POETRY_NO_INTERACTION=1 \
@@ -32,63 +36,6 @@ COPY pyproject.toml poetry.lock ./
 RUN pip install poetry
 RUN poetry install --without dev --no-root && rm -rf $POETRY_CACHE_DIR
 
-# Alpine doesn't support playwright
-FROM python:3.14.2-slim AS development
-
-ARG UID=1000
-ENV USER=app
-ENV APP_DIR=/app
-RUN addgroup --gid $UID --system ${USER} \
-    && adduser --uid $UID --system ${USER} --ingroup ${USER} \
-    && mkdir -p ${APP_DIR} \
-    && chown ${USER}:${USER} ${APP_DIR}
-
-ENV VIRTUAL_ENV=${APP_DIR}/.venv
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
-
-USER root
-WORKDIR ${APP_DIR}
-
-# Install system dependencies needed for Playwright
-RUN apt-get update && apt-get install -y \
-    fonts-liberation \
-    libasound2 \
-    libatk-bridge2.0-0 \
-    libatk1.0-0 \
-    libatspi2.0-0 \
-    libcups2 \
-    libdbus-1-3 \
-    libdrm2 \
-    libexpat1 \
-    libgbm1 \
-    libglib2.0-0 \
-    libgtk-3-0 \
-    libnspr4 \
-    libnss3 \
-    libx11-6 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxext6 \
-    libxfixes3 \
-    libxrandr2 \
-    libxss1 \
-    libxtst6 \
-    xdg-utils \
-    && rm -rf /var/lib/apt/lists/*
-
-ENV POETRY_NO_INTERACTION=1 \
-    POETRY_VIRTUALENVS_IN_PROJECT=1 \
-    POETRY_VIRTUALENVS_CREATE=1 \
-    POETRY_CACHE_DIR=/tmp/poetry_cache \
-    PLAYWRIGHT_BROWSERS_PATH=${APP_DIR}/browsers
-
-COPY pyproject.toml poetry.lock ./
-RUN pip install poetry
-RUN poetry install --no-root && rm -rf $POETRY_CACHE_DIR
-RUN poetry run playwright install --with-deps chromium
-
-USER ${USER}
-COPY --chown=${USER}:${USER} . .
 
 FROM python_base
 
@@ -104,4 +51,4 @@ RUN python ./manage.py collectstatic --noinput
 
 EXPOSE 8000
 
-CMD ["/app/.venv/bin/gunicorn", "--bind", "0.0.0.0:8000", "lung_cancer_screening.wsgi"]
+ENTRYPOINT ["/app/.venv/bin/gunicorn", "--bind", "0.0.0.0:8000", "lung_cancer_screening.wsgi"]

Dockerfile.dev

@@ -0,0 +1,59 @@
+# Alpine doesn't support playwright
+FROM python:3.14.1-slim
+
+ARG UID=1000
+ENV USER=app
+ENV APP_DIR=/app
+RUN addgroup --gid $UID --system ${USER} \
+    && adduser --uid $UID --system ${USER} --ingroup ${USER} \
+    && mkdir -p ${APP_DIR} \
+    && chown ${USER}:${USER} ${APP_DIR}
+
+ENV VIRTUAL_ENV=${APP_DIR}/.venv
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+
+USER root
+WORKDIR ${APP_DIR}
+
+# Install system dependencies needed for Playwright
+RUN apt-get update && apt-get install -y \
+    fonts-liberation \
+    libasound2 \
+    libatk-bridge2.0-0 \
+    libatk1.0-0 \
+    libatspi2.0-0 \
+    libcups2 \
+    libdbus-1-3 \
+    libdrm2 \
+    libexpat1 \
+    libgbm1 \
+    libglib2.0-0 \
+    libgtk-3-0 \
+    libnspr4 \
+    libnss3 \
+    libx11-6 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxext6 \
+    libxfixes3 \
+    libxrandr2 \
+    libxss1 \
+    libxtst6 \
+    xdg-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV POETRY_NO_INTERACTION=1 \
+    POETRY_VIRTUALENVS_IN_PROJECT=1 \
+    POETRY_VIRTUALENVS_CREATE=1 \
+    POETRY_CACHE_DIR=/tmp/poetry_cache \
+    PLAYWRIGHT_BROWSERS_PATH=${APP_DIR}/browsers
+
+COPY pyproject.toml poetry.lock ./
+RUN pip install poetry
+RUN poetry install --no-root && rm -rf $POETRY_CACHE_DIR
+RUN poetry run playwright install --with-deps chromium
+
+USER ${USER}
+COPY --chown=${USER}:${USER} . .
+
+CMD ["/usr/bin/python", "manage.py", "runserver", "0.0.0.0:8000"]

docker-compose.yml

@@ -4,9 +4,7 @@ services:
   web:
     build:
       context: .
-      dockerfile: Dockerfile
-      target: development
-    command: python manage.py runserver 0.0.0.0:8000
+      dockerfile: Dockerfile.dev
     ports:
       - "8000:8000"
     env_file:

makefiles/dev.mk

@@ -19,20 +19,17 @@ dev-logs:
 	$(DOCKER_COMPOSE_CMD) logs -f
 
 dev-shell:
-	$(DOCKER_COMPOSE_CMD) run --rm web bash
+	$(DOCKER_COMPOSE_CMD) run --rm --entrypoint /bin/sh web
 
 dev-migrate:
-	$(DOCKER_COMPOSE_CMD) run --rm web python manage.py migrate
+	$(DOCKER_COMPOSE_CMD) run --rm --entrypoint /app/.venv/bin/python web manage.py migrate
 
 dev-makemigrations:
-	$(DOCKER_COMPOSE_CMD) run --rm web python manage.py makemigrations
+	$(DOCKER_COMPOSE_CMD) run --rm --entrypoint /app/.venv/bin/python web manage.py makemigrations
 
 dev-clean:
 	$(DOCKER_COMPOSE_CMD) down -v --remove-orphans
 	$(DOCKER_COMPOSE_CMD) system prune -f
 
-dev-test:
-	$(DOCKER_COMPOSE_CMD) run --rm web python manage.py test
-
 dev-lint-fix:
-	$(DOCKER_COMPOSE_CMD) run --rm web poetry run ruff check --no-cache lung_cancer_screening --fix
+	$(DOCKER_COMPOSE_CMD) run --rm --entrypoint /app/.venv/bin/ruff web check --no-cache lung_cancer_screening --fix