domverse/photoanalyzer
1
0
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

US08-02 — Build a Reproducible Application Image #88

New Issue
Closed
opened 2026-08-17 21:11:35 +02:00 by domverse · 3 comments
domverse commented 2026-08-17 21:11:35 +02:00
Owner
Copy Link

Source specification: delivery_backlog/stories/US08-02-container-image.md

US08-02 — Build a Reproducible Application Image

Epic: E08

As an operator, I want one image that can run either application role, so deployment is
a pull instead of a Python environment I have to reproduce by hand.

Context

The application shells out to exiftool and immich-go, writes into the library as a
normal filesystem user, and serves a static frontend from frontend/. All three have to
be true inside the image, or the container starts and then fails on the first real
operation.

Acceptance criteria

  • A Dockerfile builds from a pinned Python base, installs the project and its runtime
    dependencies, and contains no test, playwright, or build-only tooling in the final
    layer.
  • exiftool and immich-go are present at pinned versions, and their versions are
    recorded in the image and reported by python -m photo_pipeline diagnostics.
  • The image runs as a non-root user whose UID/GID are build-time arguments, so files
    the application renames or writes keep the ownership the host library expects.
  • One entrypoint selects the role: serve or worker, passing through the existing
    CLI arguments; no supervisor runs two roles in one container.
  • serve containers declare a HEALTHCHECK against /api/v1/health/ready, so an
    unmigrated or misconfigured database is not reported healthy.
  • The image contains no secrets, no library data, no database, and no .git; the build
    context is constrained by .dockerignore.
  • Image build is reproducible from a clean checkout and documented in README.md.

Automated tests

  • A build-and-run test asserts the image starts, reports ready, serves the frontend
    index, and returns the pinned exiftool and immich-go versions.
  • A test asserts the container refuses to run as UID 0 and that a file created by the
    container is owned by the configured UID/GID.

Dependencies

  • US07-05
Source specification: [delivery_backlog/stories/US08-02-container-image.md](https://git.domverse-berlin.eu/domverse/photoanalyzer/src/branch/main/delivery_backlog/stories/US08-02-container-image.md) # US08-02 — Build a Reproducible Application Image Epic: [E08](https://git.domverse-berlin.eu/domverse/photoanalyzer/src/branch/main/delivery_backlog/E08-container-deployment.md) As an operator, I want one image that can run either application role, so deployment is a pull instead of a Python environment I have to reproduce by hand. ## Context The application shells out to `exiftool` and `immich-go`, writes into the library as a normal filesystem user, and serves a static frontend from `frontend/`. All three have to be true inside the image, or the container starts and then fails on the first real operation. ## Acceptance criteria - A `Dockerfile` builds from a pinned Python base, installs the project and its runtime dependencies, and contains no test, playwright, or build-only tooling in the final layer. - `exiftool` and `immich-go` are present at pinned versions, and their versions are recorded in the image and reported by `python -m photo_pipeline diagnostics`. - The image runs as a non-root user whose UID/GID are build-time arguments, so files the application renames or writes keep the ownership the host library expects. - One entrypoint selects the role: `serve` or `worker`, passing through the existing CLI arguments; no supervisor runs two roles in one container. - `serve` containers declare a `HEALTHCHECK` against `/api/v1/health/ready`, so an unmigrated or misconfigured database is not reported healthy. - The image contains no secrets, no library data, no database, and no `.git`; the build context is constrained by `.dockerignore`. - Image build is reproducible from a clean checkout and documented in `README.md`. ## Automated tests - A build-and-run test asserts the image starts, reports ready, serves the frontend index, and returns the pinned `exiftool` and `immich-go` versions. - A test asserts the container refuses to run as UID 0 and that a file created by the container is owned by the configured UID/GID. ## Dependencies - US07-05
domverse added a new dependency 2026-08-17 21:12:18 +02:00
#42 US07-05 — Deliver Backup and Operational Recovery
domverse added a new dependency 2026-08-17 21:12:19 +02:00
#89 US08-03 — Compose the Runtime and Mount the Library Safely
domverse added a new dependency 2026-08-17 21:12:19 +02:00
#90 US08-04 — Publish and Deploy from Gitea Actions
domverse added a new dependency 2026-08-17 21:12:20 +02:00
#91 US08-05 — Automate Container Deployment Acceptance
domverse added this to the Photo Analyzer Delivery project 2026-08-17 21:15:36 +02:00
domverse added this to the E08 — Container Deployment milestone 2026-08-17 21:17:42 +02:00
domverse added status/in-progress and removed status/backlog labels 2026-08-18 22:16:51 +02:00
domverse self-assigned this 2026-08-18 22:16:52 +02:00
domverse commented 2026-08-18 22:16:52 +02:00
Author
Owner
Copy Link

Claimed for implementation on branch us/US08-02-build-a-reproducible-application-image.

Claimed for implementation on branch `us/US08-02-build-a-reproducible-application-image`.
domverse added status/review and removed status/in-progress labels 2026-08-18 23:10:53 +02:00
domverse commented 2026-08-18 23:10:53 +02:00
Author
Owner
Copy Link

Submitted for review: #97

Tests passed:

  • work_item/scripts/python -m unittest discover -s work_item/tests -v
  • work_item/scripts/python -m pytest tests -q
  • work_item/scripts/python -m pytest tests/integration/test_container_image.py tests/e2e/test_container_runtime.py -q
Submitted for review: https://git.domverse-berlin.eu/domverse/photoanalyzer/pulls/97 Tests passed: - `work_item/scripts/python -m unittest discover -s work_item/tests -v` - `work_item/scripts/python -m pytest tests -q` - `work_item/scripts/python -m pytest tests/integration/test_container_image.py tests/e2e/test_container_runtime.py -q`
domverse added status/done and removed status/review labels 2026-08-18 23:11:17 +02:00
domverse commented 2026-08-18 23:11:18 +02:00
Author
Owner
Copy Link

Completed and merged via PR #97.

Completed and merged via PR #97.
domverse moved this to Done in Photo Analyzer Delivery on 2026-08-18 23:30:08 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/backend
Backend services, jobs, or API
 area/database
Schema, persistence, migration, or queries
 area/filesystem
Filesystem identity, mutation, or storage
 area/frontend
Browser UI and client-side application
 area/integration
External tools or provider integrations
 area/testing
Automated test suites, fixtures, and tooling
 priority/critical
Release-blocking safety or correctness
 priority/high
Important phase outcome
 priority/normal
Normal planned work
 status/backlog
Awaiting dependency eligibility or prioritization
 status/blocked
Cannot proceed without an explicit resolution
 status/done
Merged, tested, and completed
 status/in-progress
Currently being implemented
 status/ready
Eligible to be claimed
 status/review
Submitted in a pull request for review
 type/feature
User-facing or domain capability
 type/hardening
Security, resilience, operations, or release hardening
 type/migration
Donor extraction, migration, or legacy consolidation
 type/test
Automated test infrastructure or acceptance coverage
No Label area/backend area/integration priority/high status/done type/feature
Milestone
No items
No Milestone E08 — Container Deployment
Projects
Clear projects
No project Photo Analyzer Delivery
Assignees
Clear assignees
domverse
No Assignees domverse
1 Participants
Notifications
Due Date
No due date set.
Blocks
#89 US08-03 — Compose the Runtime and Mount the Library Safely
domverse/photoanalyzer
#90 US08-04 — Publish and Deploy from Gitea Actions
domverse/photoanalyzer
#91 US08-05 — Automate Container Deployment Acceptance
domverse/photoanalyzer
Depends on
#42 US07-05 — Deliver Backup and Operational Recovery
domverse/photoanalyzer
Reference: domverse/photoanalyzer#88
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?