From 5c35b05c20f43bf14edbbfa5ee811983dbd47456 Mon Sep 17 00:00:00 2001
From: Johan Lundberg <lundberg@snakedesert.se>
Date: Sun, 19 Jul 2026 23:15:41 +0200
Subject: [PATCH 1/4] pin uv

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 1847755..b026555 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,7 +6,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy
 
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:0.11.29 /uv /uvx /bin/
 
 WORKDIR /app
 

From 1f943343340a346352ac65d3f0bb4445e53b3089 Mon Sep 17 00:00:00 2001
From: Johan Lundberg <lundberg@snakedesert.se>
Date: Sun, 19 Jul 2026 23:16:34 +0200
Subject: [PATCH 2/4] use bind-mounted source during development

---
 Dockerfile | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index b026555..dd27fea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,17 +17,19 @@ RUN uv sync --frozen --no-install-project --no-dev
 # ---- Dev stage: hot-reload for local development ----
 FROM base AS dev
 
-# Also install dev dependencies
+# Also install dev dependencies. The project source is bind-mounted at runtime.
 RUN uv sync --frozen --no-install-project
 
 # Source is bind-mounted at runtime via docker-compose
 ENV OIDC_OP_ISSUER=http://localhost:8000 \
     OIDC_OP_DEBUG=true \
-    OIDC_OP_SESSION_HTTPS_ONLY=false
+    OIDC_OP_SESSION_HTTPS_ONLY=false \
+    PATH="/app/.venv/bin:$PATH" \
+    PYTHONPATH=/app/src
 
 EXPOSE 8000
 
-CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
+CMD ["uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--reload", "--reload-dir", "/app/src"]
 

From ac06e5621715f1a2f8a8b2356e782627d8b3369d Mon Sep 17 00:00:00 2001
From: Johan Lundberg <lundberg@snakedesert.se>
Date: Sun, 19 Jul 2026 23:17:54 +0200
Subject: [PATCH 3/4] create unprivileged user

run uvicorn directly instead of via uv
---
 Dockerfile | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index dd27fea..27a01b3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,10 +41,21 @@ COPY README.md ./
 COPY src/ src/
 RUN uv sync --frozen --no-dev
 
-ENV OIDC_OP_ISSUER=http://localhost:8000
+# Use the venv built above directly — avoids `uv run` re-syncing (and
+# needing network access to re-resolve/rebuild) at container startup.
+ENV PATH="/app/.venv/bin:$PATH"
+
+RUN groupadd --system porchlight \
+    && useradd --system --gid porchlight --home-dir /app porchlight \
+    && mkdir -p /app/data \
+    && chown porchlight:porchlight /app/data \
+    && mkdir -p /app/config \
+    && chown porchlight:porchlight /app/config
+
+USER porchlight
 
 EXPOSE 8000
 
-CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
+CMD ["uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--workers", "4"]

From bde90cbb9f3754c6c7de7bdf5f7b0b29b3517d20 Mon Sep 17 00:00:00 2001
From: Johan Lundberg <lundberg@snakedesert.se>
Date: Sun, 19 Jul 2026 23:18:27 +0200
Subject: [PATCH 4/4] always require OIDC_OP_ISSUER and OIDC_OP_SESSION_SECRET
 to be set when using compose

---
 docker-compose.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 4af9537..a66cd4b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,8 +6,8 @@ services:
     ports:
       - "8000:8000"
     environment:
-      OIDC_OP_ISSUER: "http://localhost:8000"
-      OIDC_OP_SESSION_SECRET: "change-me-in-production"
+      OIDC_OP_ISSUER: "${OIDC_OP_ISSUER:?set OIDC_OP_ISSUER to the public HTTPS URL}"
+      OIDC_OP_SESSION_SECRET: "${OIDC_OP_SESSION_SECRET:?set OIDC_OP_SESSION_SECRET to a random secret}"
     volumes:
       - app-data:/app/data
     profiles: