Container Implementation

Container Implementation#

Docker

A .dockerignore is mandatory to prevent importing .env files (secret leakage).

🛡️ Secure Build Context

# .dockerignore
.env
.git/
.venv/
__pycache__/

⚙️ Build

Execute from the repository root, passing the manifest path:
```
docker build -t my-img -f containers/pipeline.Dockerfile .
```
🚀 Execute

Execute from the repository root, injecting the .env file dynamically:
```
docker run --rm --env-file .env my-img
```

Apptainer

Explicit Copying over Ignore Files Apptainer lacks a native .dockerignore equivalent. To prevent .env files from entering the image, directories must be copied explicitly.

🛡️ Secure Build Context

%files
    # Explicitly avoid local .env files
    pyproject.toml /app/
    src /app/src
    config /app/config
    scripts /app/scripts

⚙️ Build

Execute from the repository root, passing the manifest path:
```
apptainer build img.sif containers/pipeline.def
```
🚀 Execute
Apptainer supports the --env-file flag (v1.1.0+) for symmetric runtime injection:
```
apptainer run --env-file .env img.sif
```