1 files changed, 20 insertions, 0 deletions
diff --git a/worker/Dockerfile b/worker/Dockerfile
new file mode 100644
index 0000000..f23bf61
--- /dev/null
+++ b/worker/Dockerfile
@@ -0,0 +1,20 @@
+# Strategy Lab Python worker image
+# - fetch: network-enabled; backtest: --network none
+# - non-root uid 10001, read-only rootfs at runtime, /output writable only
+FROM python:3.11-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1
+
+WORKDIR /app
+
+RUN adduser --uid 10001 --disabled-password --gecos "" worker
+
+COPY requirements-worker.txt /tmp/requirements-worker.txt
+RUN pip install --no-cache-dir -r /tmp/requirements-worker.txt
+
+COPY worker /app/worker
+
+USER worker
+
+# /input request, /data dataset objects (read-only mounts); /output writable result dir
+CMD ["python", "-m", "worker.main"]