containerizelisted

# Containerize a Python Application Build a reproducible uv-managed Python image locally, verify it, and publish only within the user's authorized registry scope. [cloud-run](../cloud-run/SKILL.md) deploys it, [trivy](../trivy/SKILL.md) scans it, and [cosign](../cosign/SKILL.md) owns provenance. ## Workflow 1. **Adopt the templates**: copy [Dockerfile](references/Dockerfile) and [.dockerignore](references/.dockerignore). Replace `<slug>` with the installed Python console script and verify both image digests before use. 1. **Build locally**: emit a Docker archive so the first build and scan require no registry mutation. ```bash mkdir -p tmp docker buildx build --output type=docker,dest=tmp/image.tar . ``` 1. **Wire the gate** into `mise.toml`; `check:image` scans the exact archive produced by `build:image`. ```toml [tasks."build:image"] description = "Build the Python OCI image locally" run = ["mkdir -p tmp", "docker buildx build --output type=docker,dest=tmp/image.tar ."] [tasks."check:image"] description = "Scan the local OCI image" depends = ["build:image"] run = "trivy --config trivy.yaml image --skip-dirs '' --input tmp/image.tar" ``` 1. **Exercise the container**: load it with `docker load --input tmp/image.tar`. For the Python web starter, supply required application settings through a reviewed local environment file, then run `docker run --rm -p 127.0.0.1:8080:8080 --env-file <runtime-env-file> -e HOST=0.0.0.0 -e PORT=8080