Skip to content

fix(api): multi-stage build, non-root user, add healthcheck #612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pavsoss wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −13
Open

fix(api): multi-stage build, non-root user, add healthcheck #612

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 11 additions & 13 deletions Dockerfile.api
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,16 @@
FROM python:3.12-slim

WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
curl \
git \
FROM python:3.12-slim AS builder
RUN apt-get update && apt-get install -y --no-install-recommends build-essential git \
&& rm -rf /var/lib/apt/lists/*

WORKDIR /build
COPY . .
RUN pip wheel --no-cache-dir --wheel-dir /wheels .

RUN pip install --no-cache-dir --upgrade pip && \
pip install --no-cache-dir -e .

FROM python:3.12-slim AS runtime
RUN useradd --create-home --uid 10001 agentwatch
COPY --from=builder /wheels /wheels
RUN pip install --no-cache-dir /wheels/*.whl && rm -rf /wheels
USER agentwatch
EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
Comment on lines +14 to +15

@coderabbitai coderabbitai Bot Jul 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Add a timeout to the urlopen call in the healthcheck.

urllib.request.urlopen is invoked without a timeout argument. If the API accepts the TCP connection but hangs before responding, the Python process will block until Docker's --timeout=10s kills it — producing a less informative timeout failure and holding a connection open longer than necessary. Passing timeout=5 ensures the check fails fast and cleanly within the Docker timeout window.

Additionally, when the /health endpoint returns 503 (degraded), urlopen raises HTTPError and Python prints a full traceback to stderr on every check interval, which clutters container logs. Wrapping in a try/except would suppress the noise while still exiting non-zero.

🛡️ Proposed healthcheck improvement 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
+    CMD python -c "import urllib.request, sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health', timeout=5).status == 200 else 1)" || exit 1
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD python -c "import urllib.request, sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health', timeout=5).status == 200 else 1)" || exit 1
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile.api` around lines 14 - 15, Update the Dockerfile healthcheck’s
urllib.request.urlopen call to pass timeout=5, and wrap the request in exception
handling that suppresses HTTPError and other expected healthcheck failures while
still exiting non-zero. Keep successful /health responses passing and ensure
failures complete within Docker’s 10-second timeout without traceback output.

CMD ["uvicorn", "agentwatch.api.server:app", "--host", "0.0.0.0", "--port", "8000"]
Loading