From 007a67356c953deebdd0c62282a109be65c7f781 Mon Sep 17 00:00:00 2001
From: Ee Durbin <ewdurbin@gmail.com>
Date: Tue, 6 Jun 2023 14:21:07 -0400
Subject: [PATCH] Dockerfile: Do not pip install --user, venv instead (#3452)

Co-authored-by: Thomas <ThomasLaPiana@users.noreply.github.com>
Co-authored-by: Thomas <thomas.lapiana+github@pm.me>
---
 CHANGELOG.md |  1 +
 Dockerfile   | 21 +++++++++++++--------
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8c4ca63217..418d86f891 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,7 @@ The types of changes are:
 - Enabled Privacy Experience beta flag [#3364](https://github.com/ethyca/fides/pull/3364)
 - Removed ExperienceConfig.delivery_mechanism constraint [#3387](https://github.com/ethyca/fides/pull/3387)
 - Updated privacy experience UI forms to reflect updated experience config fields [#3402](https://github.com/ethyca/fides/pull/3402)
+- Use a venv in the Dockerfile for installing Python deps [#3452](https://github.com/ethyca/fides/pull/3452)
 - Bump SlowAPI Version [#3456](https://github.com/ethyca/fides/pull/3456)
 - Bump Psycopg2-binary Version [#3473](https://github.com/ethyca/fides/pull/3473)
 - Reduced duplication between PrivacyExperience and PrivacyExperienceConfig [#3470](https://github.com/ethyca/fides/pull/3470)
diff --git a/Dockerfile b/Dockerfile
index d035cf55d9..09208864f2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,6 @@
 # If you update this, also update `DEFAULT_PYTHON_VERSION` in the GitHub workflow files
 ARG PYTHON_VERSION="3.10.11"
 
-
 #########################
 ## Compile Python Deps ##
 #########################
@@ -18,15 +17,21 @@ RUN apt-get update && \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
+# Activate a Python venv
+RUN python3 -m venv /opt/fides
+ENV PATH="/opt/fides/bin:${PATH}"
+
 # Install Python Dependencies
-COPY dangerous-requirements.txt .
-RUN if [ $TARGETPLATFORM != linux/arm64 ] ; then pip install --user -U pip --no-cache-dir install -r dangerous-requirements.txt ; fi
+RUN pip --no-cache-dir --disable-pip-version-check install --upgrade pip setuptools wheel
 
-COPY dev-requirements.txt .
-RUN pip install --user -U pip --no-cache-dir install -r dev-requirements.txt
+COPY dangerous-requirements.txt .
+RUN if [ $TARGETPLATFORM != linux/arm64 ] ; then pip install --no-cache-dir install -r dangerous-requirements.txt ; fi
 
 COPY requirements.txt .
-RUN pip install --user -U pip --no-cache-dir install -r requirements.txt
+RUN pip install --no-cache-dir install -r requirements.txt
+
+COPY dev-requirements.txt .
+RUN pip install --no-cache-dir install -r dev-requirements.txt
 
 ##################
 ## Backend Base ##
@@ -35,8 +40,8 @@ FROM python:${PYTHON_VERSION}-slim-bullseye as backend
 ARG TARGETPLATFORM
 
 # Loads compiled requirements and adds the to the path
-COPY --from=compile_image /root/.local /root/.local
-ENV PATH=/root/.local/bin:$PATH
+COPY --from=compile_image /opt/fides /opt/fides
+ENV PATH=/opt/fides/bin:$PATH
 
 # These are all required for MSSQL
 RUN : \