From cf02415e9e46cc4dc9427e7cf88dc0b067896fae Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Fri, 26 Jun 2026 17:56:51 +0800
Subject: [PATCH] fix: P3-3 add multi-stage build to api.Dockerfile

---
 infra/docker/api.Dockerfile | 43 +++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/infra/docker/api.Dockerfile b/infra/docker/api.Dockerfile
index e3f56e3d6..7c21f3b67 100644
--- a/infra/docker/api.Dockerfile
+++ b/infra/docker/api.Dockerfile
@@ -1,16 +1,51 @@
-FROM python:3.12-slim
+# ============== Stage 1: Builder ==============
+FROM python:3.12-slim AS builder
 WORKDIR /app
-ENV PYTHONPATH=/app
-ENV PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/
-ENV PIP_TRUSTED_HOST=mirrors.aliyun.com
+ENV PYTHONUNBUFFERED=1 \
+    PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/ \
+    PIP_TRUSTED_HOST=mirrors.aliyun.com
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Python dependencies
 COPY requirements.txt ./
 RUN python -m pip install --upgrade pip setuptools wheel && \
     pip install --no-cache-dir --default-timeout=120 --retries 10 -r requirements.txt
+
+# ============== Stage 2: Production ==============
+FROM python:3.12-slim AS production
+WORKDIR /app
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1
+
+# Install runtime dependencies only
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq5 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy installed packages from builder
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+
+# Copy application code
+ENV PYTHONPATH=/app
 COPY apps/api /app/apps/api
 COPY packages /app/packages
 COPY scripts /app/scripts
 COPY alembic /app/alembic
 COPY alembic.ini /app/alembic.ini
+
 WORKDIR /app/apps/api
 EXPOSE 8000
+
+# Run as non-root user for security
+RUN useradd --create-home --shell /bin/bash appuser && \
+    chown -R appuser:appuser /app
+USER appuser
+
 CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]