Task: Package and publish deployer-backend-api as a production Docker image

[hyde-repo]

Task: Package and publish deployer-backend-api as a production Docker image

Description
Push the latest version of deployer-backend-api and set up a Docker-based build pipeline that installs the deployer CLI, runs the production build, and publishes the resulting image. Deliver a two-stage Dockerfile (builder + runtime/pusher) based on the latest Ubuntu Server LTS, and a docker-compose.yml to build and validate the image locally. An up-to-date OpenAPI/Swagger JSON file must also be provided so the Kong API deployment can start in parallel.

Working branch

• dev

Files / locations

• deployer-backend-api/Dockerfile - two-stage build (builder → runtime)
• deployer-backend-api/docker-compose.yml - local build & test orchestration
• deployer-backend-api/openapi.json (or swagger.json) - up-to-date API spec
• deployer-backend-api/README.md - update with build & push instructions

Requirements

• Base image: latest Ubuntu Server LTS
• Stage 1 (builder): install deployer CLI, run prod build
• Stage 2 (runtime): minimal image running the API
• Image must be testable locally via docker compose up
• OpenAPI/Swagger JSON exported and committed, reflecting the current API surface (needed to bootstrap Kong API gateway config)
• README updated with clear build & push commands if the current docs are missing or outdated

[t0kubetsu]

Implementation complete — PR open on dev

All four deliverables from the issue spec have been committed to the dev branch and a PR is open: feat(docker): two-stage production image on Debian bookworm + openapi.json.

What was done

Deliverable	Status	Notes
Dockerfile	✅	Two-stage (builder → runtime), Debian Bookworm base
docker-compose.yml	✅	Production-oriented, no source bind-mounts, IMAGE_NAME driven
openapi.json	✅	Exported from live FastAPI route table, committed at repo root
README.md	✅	New Docker: Build & Publish section with GHCR commands

Base image: Debian Bookworm (not Ubuntu Server LTS)

The issue specified Ubuntu Server LTS. We chose Debian Bookworm instead — specifically python:3.13-bookworm, the Docker Official Image, which uses upstream CPython compiled from source and does not ship the EXTERNALLY-MANAGED marker. Dependencies are also installed into a virtualenv (/opt/venv), which bypasses PEP 668 on any distro.

Note: Debian 12 itself does enforce PEP 668 on its apt-installed Python — the reason this image is unaffected is the Docker Official Image base and the virtualenv, not the distro choice. Debian is preferred here because the official Python Docker images are themselves Debian-based, making it the more predictable foundation.

Quick validation

git fetch origin dev
git checkout dev
docker compose build
VAULT_PASSWORD=test docker compose up
curl http://localhost:8000/docs/openapi.json