fix(docker): place venv under opt

Author: tuxpeople

AGENTS.md

@@ -376,18 +376,18 @@ Complete documentation: **API.md**
 ```dockerfile
 # Stage 1: Build dependencies in -dev image
 FROM cgr.dev/chainguard/python:latest-dev AS build
-RUN python -m venv /home/nonroot/venv && \
-    /home/nonroot/venv/bin/pip install --upgrade 'pip<25.2' setuptools wheel
+RUN python -m venv /tmp/venv && \
+    /tmp/venv/bin/pip install --upgrade 'pip<25.2' setuptools wheel
 
 # Stage 2: Install Python packages
 FROM build AS build-venv
 COPY requirements.txt /tmp/requirements.txt
-RUN /home/nonroot/venv/bin/pip install -r /tmp/requirements.txt
+RUN /tmp/venv/bin/pip install -r /tmp/requirements.txt
 
 # Stage 3: Minimal runtime image (distroless)
 FROM cgr.dev/chainguard/python:latest
-COPY --from=build-venv /home/nonroot/venv /home/nonroot/venv
-ENV PATH="/home/nonroot/venv/bin:$PATH"
+COPY --from=build-venv /tmp/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 ```
 
 **Kubernetes** (if used):

Dockerfile

@@ -5,13 +5,13 @@ FROM cgr.dev/chainguard/python:latest-dev AS build
 
 # Create virtualenv and upgrade build tools
 # Pin pip to avoid CVE-2025-8869 in pip 25.2 (when fix is available)
-RUN python -m venv /home/nonroot/venv && \
-    /home/nonroot/venv/bin/pip install --upgrade 'pip<25.2' setuptools wheel
+RUN python -m venv /tmp/venv && \
+    /tmp/venv/bin/pip install --upgrade 'pip<25.2' setuptools wheel
 
 # Stage 2: Install Python dependencies
 FROM build AS build-venv
 COPY --chown=nonroot:nonroot requirements.txt /tmp/requirements.txt
-RUN /home/nonroot/venv/bin/pip install \
+RUN /tmp/venv/bin/pip install \
     --disable-pip-version-check \
     --no-cache-dir \
     -r /tmp/requirements.txt
@@ -26,13 +26,13 @@ LABEL org.opencontainers.image.source="https://github.com/tuxpeople/python-ipam"
 LABEL org.opencontainers.image.description="Secure IPAM built on Chainguard distroless Python"
 
 # Copy virtualenv from build stage with correct ownership
-COPY --from=build-venv --chown=nonroot:nonroot /home/nonroot/venv /home/nonroot/venv
+COPY --from=build-venv --chown=nonroot:nonroot /tmp/venv /opt/venv
 
 # Set PATH to use virtualenv
-ENV PATH="/home/nonroot/venv/bin:$PATH"
+ENV PATH="/opt/venv/bin:$PATH"
 
 # Activate virtualenv by setting VIRTUAL_ENV
-ENV VIRTUAL_ENV="/home/nonroot/venv"
+ENV VIRTUAL_ENV="/opt/venv"
 
 # Set Flask environment variables
 ENV FLASK_APP=app.py
@@ -53,5 +53,5 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
     CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5000/').read()" || exit 1
 
 # Use virtualenv Python so installed packages (e.g., gunicorn) are available
-ENTRYPOINT ["/home/nonroot/venv/bin/python"]
+ENTRYPOINT ["/opt/venv/bin/python"]
 CMD ["-m","gunicorn","--bind","0.0.0.0:5000","--workers","4","--timeout","120","app:app"]