Fix logic bug in concept tagging and harden Dockerfile security#146
Open
RinZ27 wants to merge 1 commit intonasa:masterfrom
Open
Fix logic bug in concept tagging and harden Dockerfile security#146RinZ27 wants to merge 1 commit intonasa:masterfrom
RinZ27 wants to merge 1 commit intonasa:masterfrom
Conversation
abstract-333
added a commit
to abstract-333/apod-api
that referenced
this pull request
Feb 27, 2026
…ookworm build - Implements multi-stage build to exclude build tools - Maintains Debian Trixie base for glibc compatibility (Pillow support) - Adds non-root user for security (referenced from nasa#146) - Integrates uv with Docker cache mounts for faster builds
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I noticed a logic bug in the
get_conceptsfunction while reviewing the codebase. It was attempting to call a.get()method on a Flask request object, which would cause an immediate crash if the concept tagging feature were enabled. I've switched this to use therequestslibrary correctly and fixed the parameter mapping fromfieldstoparams.Additionally, I've updated the Dockerfile to use a non-root user. Running applications as root inside a container isn't ideal for security, so I added an
apoduser to handle the process.These changes should improve the overall stability and security posture of the service. I've left the
debug=Truein the main block alone as Gunicorn bypasses it in production anyway.