1

$ docker run --rm -it ghcr.io/astral-sh/uv:debian uv --help

1
2
3

# Dockerfile
FROM python:3.12-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# Dockerfile
FROM python:3.12-slim-trixie

# 安装器需要 curl（以及证书）来下载发布归档
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates

# 下载最新的安装器
ADD https://astral.sh/uv/install.sh /uv-installer.sh

# 运行安装器并删除它
RUN sh /uv-installer.sh && rm /uv-installer.sh

# 确保安装的二进制文件在 `PATH` 中
ENV PATH="/root/.local/bin/:$PATH"

1

COPY --from=ghcr.io/astral-sh/uv:0.12.19 /uv /uvx /bin/

1

ADD https://astral.sh/uv/0.12.19/install.sh /uv-installer.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Dockerfile
# 把项目复制到镜像中
COPY . /app

# 禁用开发依赖
ENV UV_NO_DEV=1

# 把项目同步到新环境，并断言锁文件是最新的
WORKDIR /app
RUN uv sync --locked

1
2
3

# Dockerfile
# 假设项目提供了 `my_app` 命令
CMD ["uv", "run", "my_app"]

1
2

# Dockerfile
ENV PATH="/app/.venv/bin:$PATH"

1
2

# Dockerfile
RUN uv run some_script.py

1
2
3

# Dockerfile
ENV PATH=/root/.local/bin:$PATH
RUN uv tool install cowsay

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

$ docker run -it $(docker build -q .) /bin/bash -c "cowsay -t hello"
  _____
| hello |
  =====
     \
      \
        ^__^
        (oo)\_______
        (__)\       )\/\
            ||----w |
            ||     ||

1

$ docker run --rm --volume .:/app --volume /app/.venv [...]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# compose.yaml
services:
  example:
    build: .

    # ...

    develop:
      # 创建 `watch` 配置以更新应用
      #
      watch:
        # 把工作目录与容器中的 `/app` 目录同步
        - action: sync
          path: .
          target: /app
          # 排除项目虚拟环境
          ignore:
            - .venv/

        # 当 `pyproject.toml` 变化时重新构建镜像
        - action: rebuild
          path: ./pyproject.toml

1
2
3

# Dockerfile
RUN uv python install --compile-bytecode
RUN uv sync --compile-bytecode

1
2

# Dockerfile
ENV UV_COMPILE_BYTECODE=1

1
2
3
4
5

# Dockerfile
ENV UV_LINK_MODE=copy

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync

1
2
3
4
5

# Dockerfile
ENV UV_PYTHON_CACHE_DIR=/root/.cache/uv/python

RUN --mount=type=cache,target=/root/.cache/uv \
    uv python install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# Dockerfile
# 安装 uv
FROM python:3.12-slim
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

# 把工作目录切换到 `app` 目录
WORKDIR /app

# 安装依赖
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --locked --no-install-project

# 把项目复制到镜像中
COPY . /app

# 同步项目
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# Dockerfile
# 安装 uv
FROM python:3.12-slim
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

WORKDIR /app

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --frozen --no-install-workspace

COPY . /app

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

# Dockerfile
# 安装 uv
FROM python:3.12-slim AS builder
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

# 两个阶段都使用系统 Python
ENV UV_PYTHON_DOWNLOADS=0

# 把工作目录切换到 `app` 目录
WORKDIR /app

# 安装依赖
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --locked --no-install-project --no-editable

# 把项目复制到中间镜像中
COPY . /app

# 同步项目
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked --no-editable

FROM python:3.12-slim

# 复制环境，但不复制源代码
COPY --from=builder /app/.venv /app/.venv

# 运行应用
CMD ["/app/.venv/bin/hello"]

1
2
3

# Dockerfile
RUN --mount=from=ghcr.io/astral-sh/uv,source=/uv,target=/bin/uv \
    uv sync

1
2

# Dockerfile
RUN uv pip install --system ruff

1
2

# Dockerfile
ENV UV_SYSTEM_PYTHON=1

1
2
3
4
5
6

# Dockerfile
RUN uv venv /opt/venv
# 自动使用该虚拟环境
ENV VIRTUAL_ENV=/opt/venv
# 把环境中的入口点放到路径最前面
ENV PATH="/opt/venv/bin:$PATH"

1
2

# Dockerfile
RUN uv pip install ruff

1
2
3

# Dockerfile
COPY requirements.txt .
RUN uv pip install -r requirements.txt

1
2
3
4
5

# Dockerfile
COPY pyproject.toml .
RUN uv pip install -r pyproject.toml
COPY . .
RUN uv pip install -e .

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

$ gh attestation verify --owner astral-sh oci://ghcr.io/astral-sh/uv:latest
Loaded digest sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx for oci://ghcr.io/astral-sh/uv:latest
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com
- Source Repository Owner URI must match:... https://github.com/astral-sh
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Subject Alternative Name must match regex: (?i)^https://github.com/astral-sh/

✓ Verification succeeded!

sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx was attested by:
REPO          PREDICATE_TYPE                  WORKFLOW
astral-sh/uv  https://slsa.dev/provenance/v1  .github/workflows/build-docker.yml@refs/heads/main

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

$ REPO=astral-sh/uv
$ gh attestation download --repo $REPO oci://ghcr.io/${REPO}:latest
Wrote attestations to file sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.jsonl.
Any previous content has been overwritten

The trusted metadata is now available at sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.jsonl
$ docker buildx imagetools inspect ghcr.io/${REPO}:latest --format "{{json .Manifest}}" > manifest.json
$ cosign verify-blob-attestation \
    --new-bundle-format \
    --bundle "$(jq -r .digest manifest.json).jsonl"  \
    --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
    --certificate-identity-regexp="^https://github\.com/${REPO}/.*" \
    <(jq -j '.|del(.digest,.size)' manifest.json)
Verified OK