Пример Dockerfile для Django приложения: итог и пошаговая инструкция

# Подготовка среды
FROM python:3.13-slim-bullseye AS python

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=off \
    PIP_DISABLE_PIP_VERSION_CHECK=on \
    PIP_DEFAULT_TIMEOUT=30 \
    POETRY_NO_INTERACTION=1 \
    POETRY_VIRTUALENVS_IN_PROJECT=true \
    POETRY_HOME="/opt/poetry" \
    PYSETUP_PATH="/app" \
    VENV_PATH="/app/.venv" \
    POETRY_VERSION=2.1.3 \
    PIP_VERSION=25.1.1

ENV PATH="$POETRY_HOME/bin:$VENV_PATH/bin:$PATH"

RUN pip install -U "pip==$PIP_VERSION" "poetry==$POETRY_VERSION"

# Подготовка сборки и установка зависимостей
FROM python AS python-build-stage

WORKDIR $PYSETUP_PATH

# Устанавливаем системные зависимости
RUN apt-get update && apt-get install --no-install-recommends -y --fix-missing \
  build-essential \
  libpq-dev \
  libffi-dev \
  libpcre3 \
  libpcre3-dev \
  gettext \
  htop \
  git \
  vim \
  python3-all-dev

# Копируем файлы зависимостей
COPY pyproject.toml poetry.lock ./

# Устанавливаем зависимости
RUN poetry install --without=dev --no-ansi

# Копируем файлы приложения, собираем, чистим кэш
FROM python AS python-run-stage

# Устанавливаем только runtime зависимости
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        libpq5 \
        libpq-dev \
  && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
  && rm -rf /var/lib/apt/lists/*

# Копируем зависимости из этапа сборки
COPY --from=python-build-stage $PYSETUP_PATH $PYSETUP_PATH

WORKDIR $PYSETUP_PATH

# Копируем код приложения
COPY ./ ${PYSETUP_PATH}

# Компилируем Python файлы
RUN python -m compileall . > /dev/null

# Создаем непривилегированного пользователя
RUN addgroup --system django \
    && adduser --system --ingroup django django

# Копируем код с правильными правами
COPY --chown=django:django . ${PYSETUP_PATH}

# Делаем django владельцем рабочей директории
RUN chown django:django ${PYSETUP_PATH}

USER django

# Собираем статические файлы
RUN export STATIC_MODE=True && python manage.py collectstatic --noinput

######################################################
# Base Image
######################################################

FROM python:3.13-slim-bullseye AS python

ENV PYTHONUNBUFFERED=1 \
         PYTHONDONTWRITEBYTECODE=1 \
         PIP_NO_CACHE_DIR=off \
         PIP_DISABLE_PIP_VERSION_CHECK=on \
         PIP_DEFAULT_TIMEOUT=30 \
         POETRY_NO_INTERACTION=1 \
         POETRY_VIRTUALENVS_IN_PROJECT=true \
         POETRY_HOME="/opt/poetry" \
         PYSETUP_PATH="/app" \
         VENV_PATH="/app/.venv" \
         POETRY_VERSION=2.1.3 \
         PIP_VERSION=25.1.1

ENV PATH="$POETRY_HOME/bin:$VENV_PATH/bin:$PATH"

RUN pip install -U "pip==$PIP_VERSION" "poetry==$POETRY_VERSION"

######################################################
# Builder Image
######################################################
FROM python AS python-build-stage

WORKDIR $PYSETUP_PATH

# Install apt packages
RUN apt-get update && apt-get install --no-install-recommends -y --fix-missing \
  # dependencies for building Python packages
  build-essential \
  # psycopg2 dependencies
  libpq-dev \
  libffi-dev \
  libpcre3 \
  libpcre3-dev \
  gettext \
  htop \
  git \
  vim \
  python3-all-dev

# Requirements are installed here to ensure they will be cached.
# Create Python Dependency and Sub-Dependency Wheels.
COPY pyproject.toml poetry.lock ./

RUN poetry install --without=dev --no-ansi

######################################################
# Production image
######################################################
FROM python AS python-run-stage

# install required runtime dependencies, and cleanup cached files for a smaller layer
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        # psycopg2 runtime dependencies
        libpq5 \
        libpq-dev \
  # cleaning up unused files
  && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
  && rm -rf /var/lib/apt/lists/*

# All absolute dir copies ignore workdir instruction. All relative dir copies are wrt to the workdir instruction
# copy python dependency wheels from python-build-stage
COPY --from=python-build-stage $PYSETUP_PATH $PYSETUP_PATH


WORKDIR $PYSETUP_PATH

# copy application code to WORKDIR
COPY ./ ${PYSETUP_PATH}

RUN python -m compileall . > /dev/null

RUN addgroup --system django \
    && adduser --system --ingroup django django

# copy application code to WORKDIR
COPY --chown=django:django . ${PYSETUP_PATH}

# make django owner of the WORKDIR directory as well.
RUN chown django:django ${PYSETUP_PATH}

USER django

RUN export STATIC_MODE=True && python manage.py collectstatic --noinput