Dockerfile

@@ -6,7 +6,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy
 
-COPY --from=ghcr.io/astral-sh/uv:0.11.29 /uv /uvx /bin/
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
 
 WORKDIR /app
 
@@ -17,19 +17,17 @@ RUN uv sync --frozen --no-install-project --no-dev
 # ---- Dev stage: hot-reload for local development ----
 FROM base AS dev
 
-# Also install dev dependencies. The project source is bind-mounted at runtime.
+# Also install dev dependencies
 RUN uv sync --frozen --no-install-project
 
 # Source is bind-mounted at runtime via docker-compose
 ENV OIDC_OP_ISSUER=http://localhost:8000 \
     OIDC_OP_DEBUG=true \
-    OIDC_OP_SESSION_HTTPS_ONLY=false \
+    OIDC_OP_SESSION_HTTPS_ONLY=false
-    PATH="/app/.venv/bin:$PATH" \
-    PYTHONPATH=/app/src
 
 EXPOSE 8000
 
-CMD ["uvicorn", "porchlight.app:create_app", \
+CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--reload", "--reload-dir", "/app/src"]
 
@@ -41,21 +39,10 @@ COPY README.md ./
 COPY src/ src/
 RUN uv sync --frozen --no-dev
 
-# Use the venv built above directly — avoids `uv run` re-syncing (and
+ENV OIDC_OP_ISSUER=http://localhost:8000
-# needing network access to re-resolve/rebuild) at container startup.
-ENV PATH="/app/.venv/bin:$PATH"
-
-RUN groupadd --system porchlight \
-    && useradd --system --gid porchlight --home-dir /app porchlight \
-    && mkdir -p /app/data \
-    && chown porchlight:porchlight /app/data \
-    && mkdir -p /app/config \
-    && chown porchlight:porchlight /app/config
-
-USER porchlight
 
 EXPOSE 8000
 
-CMD ["uvicorn", "porchlight.app:create_app", \
+CMD ["uv", "run", "uvicorn", "porchlight.app:create_app", \
      "--factory", "--host", "0.0.0.0", "--port", "8000", \
      "--workers", "4"]

docker-compose.yml

@@ -6,8 +6,8 @@ services:
     ports:
       - "8000:8000"
     environment:
-      OIDC_OP_ISSUER: "${OIDC_OP_ISSUER:?set OIDC_OP_ISSUER to the public HTTPS URL}"
+      OIDC_OP_ISSUER: "http://localhost:8000"
-      OIDC_OP_SESSION_SECRET: "${OIDC_OP_SESSION_SECRET:?set OIDC_OP_SESSION_SECRET to a random secret}"
+      OIDC_OP_SESSION_SECRET: "change-me-in-production"
     volumes:
       - app-data:/app/data
     profiles: