发布镜像里尽量不要包含源码

Dockerfile

@@ -1,5 +1,5 @@
 # 使用Python 3.12官方镜像作为基础镜像
-FROM python:3.12-slim
+FROM python:3.12-slim AS base
 
 # 设置工作目录
 WORKDIR /app
@@ -43,17 +43,27 @@ RUN pip install --no-cache-dir playwright && \
 RUN npm install -g playwright sharp nodemailer dotenv && \
     npx playwright install chromium
 
-# 复制应用代码
-COPY . .
-
 # 创建必要的目录
-RUN mkdir -p /app/projects 
+RUN mkdir -p /app/projects
 RUN mkdir -p /app/public
 RUN mkdir -p /app/models
 
 # 下载sentence-transformers模型到models目录
 RUN python -c "from sentence_transformers import SentenceTransformer; model = SentenceTransformer('TaylorAI/gte-tiny'); model.save('/app/models/gte-tiny')"
 
+FROM base AS bytecode-builder
+
+# 复制应用代码，仅在构建阶段编译为字节码
+COPY . .
+RUN python -m compileall -b /app && \
+    find /app -type f -name '*.py' -delete && \
+    find /app -type d -name '__pycache__' -prune -exec rm -rf {} +
+
+FROM base AS runtime
+
+# 只复制编译后的应用文件，避免源码进入最终镜像层
+COPY --from=bytecode-builder /app /app
+
 # 暴露端口
 EXPOSE 8001
 
@@ -62,4 +72,4 @@ HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
     CMD curl -f http://localhost:8001/api/health || exit 1
 
 # 启动命令 - profile通过环境变量PROFILE配置，默认为balanced
-CMD ["sh", "-c", "python3 start_unified.py --profile ${PROFILE:-balanced}"]
+CMD ["sh", "-c", "python3 start_unified.pyc --profile ${PROFILE:-balanced}"]

Dockerfile.modelscope

@@ -1,5 +1,5 @@
 # 使用Python 3.12官方镜像作为基础镜像
-FROM docker.1ms.run/python:3.12-slim
+FROM docker.1ms.run/python:3.12-slim AS base
 
 # 设置工作目录
 WORKDIR /app
@@ -52,11 +52,18 @@ RUN mkdir -p /app/projects
 RUN mkdir -p /app/public
 RUN mkdir -p /app/models
 
-# 从modelscope下载sentence-transformers模型到models目录
+FROM base AS bytecode-builder
-#RUN python -c "from modelscope import snapshot_download; model_dir = snapshot_download('TaylorAI/gte-tiny'); import shutil; shutil.move(model_dir, '/app/models/gte-tiny')"
 
-# 复制应用代码
+# 复制应用代码，仅在构建阶段编译为字节码
 COPY . .
+RUN python -m compileall -b /app && \
+    find /app -type f -name '*.py' -delete && \
+    find /app -type d -name '__pycache__' -prune -exec rm -rf {} +
+
+FROM base AS runtime
+
+# 只复制编译后的应用文件，避免源码进入最终镜像层
+COPY --from=bytecode-builder /app /app
 
 # 暴露端口
 EXPOSE 8001
@@ -66,4 +73,4 @@ HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
     CMD curl -f http://localhost:8001/api/health || exit 1
 
 # 启动命令 - 使用优化的统一启动脚本
-CMD ["sh", "-c", "python3 start_unified.py --profile ${PROFILE:-balanced}"]
+CMD ["sh", "-c", "python3 start_unified.pyc --profile ${PROFILE:-balanced}"]