CAMPAIGN-54: migrate to tw-base-python base image#154
Conversation
Switch the base image from the official python:3.12-slim to Wise's standard tw-base-python:3.12 so the platform can apply consistent security patching, the com.transferwise.language label, and SLSA tooling uniformly. tw-base-python runs as the non-root user UID 65534, unlike python:slim which runs as root. To keep the build working: - USER 0 before `pip install .` so the install can write into system site-packages. - chown -R 65534 /app so the runtime user can read the app directory. - USER 65534 before the ENTRYPOINT so the container runs as non-root.
|
Comment
You can also request review from a specific team by commenting 💡 If you see something that doesn't look right, check the configuration guide. |
There was a problem hiding this comment.
Pull request overview
Changes: Maintenance (1)
This PR migrates the service container from the upstream python:3.12-slim image to the internal tw-base-python:3.12 base image, adjusting user privileges so the container runs as non-root at runtime while still allowing installation steps that need elevated permissions.
Changes:
- Switch Docker base image to
tw-base-python.arti.tw.ee/tw-base-python:3.12. - Temporarily escalate to root for
pip install ., then drop back to UID65534for runtime. - Adjust ownership of
/appto support running as the non-root user.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address review feedback: chown both UID and GID (65534:65534) so group ownership no longer stays root, and combine the pip install and chown into a single RUN to avoid an extra image layer.
|
/request-review |
|
Success 🎉 The review request was sent to the following:
If you see something that doesn't look right, follow this doc to improve our slack channel mapping. Thank you! |
Context
Part of CAMPAIGN-54. All Python services must use the standard
tw-base-pythonbase image so the platform can apply consistent security patching, thecom.transferwise.languagelabel, and SLSA tooling uniformly. Please review and make sure the changes are safe.This service was on the official
python:3.12-slimimage. This PR migrates it totw-base-python:3.12.Changes
FROM python:3.12-slimforFROM tw-base-python.arti.tw.ee/tw-base-python:3.12(same Python version).tw-base-pythonruns as the non-root user UID 65534 (unlikepython:slimwhich runs as root), sopip install .(which writes into system site-packages) is wrapped withUSER 0.chown -R 65534 /appso the runtime user can read the app directory.USER 65534before theENTRYPOINTso the container runs as non-root.Test plan
docker buildsucceeds againsttw-base-python.arti.tw.ee/tw-base-python:3.12.cfexpose exportruns as UID 65534./metricson port 5000 responds as before.