test 5

Dockerfile

@@ -16,5 +16,8 @@ COPY clone_and_run.py .
 RUN useradd -m appuser && chown -R appuser:appuser /app
 USER appuser
 
+# 设置环境变量
+ENV PATH="/home/appuser/.local/bin:${PATH}"
+
 # 启动命令
 CMD ["python", "clone_and_run.py"]

clone_and_run.py

@@ -3,17 +3,13 @@ import subprocess
 import shutil
 
 def clone_repo(token, repo_url, target_dir):
-    """常规方式克隆私有仓库"""
+    """安全克隆私有仓库"""
     try:
-        # 设置 Git 凭证助手（临时存储 Token）
-        subprocess.run(["git", "config", "--global", "credential.helper", "store"], check=True)
-        
-        # 将 Token 写入 Git 凭证文件
-        with open(os.path.expanduser("~/.git-credentials"), "w") as f:
-            f.write(f"https://{token}:x-oauth-basic@github.com\n")
+        # 构造认证 URL
+        auth_url = repo_url.replace("https://", f"https://x-access-token:{token}@")
         
         # 克隆仓库
-        subprocess.run(["git", "clone", repo_url, target_dir], check=True)
+        subprocess.run(["git", "clone", auth_url, target_dir], check=True)
         
         # 清理 .git 目录
         shutil.rmtree(os.path.join(target_dir, ".git"))
@@ -41,5 +37,8 @@ if __name__ == "__main__":
     # 安装依赖
     subprocess.run(["pip", "install", "--no-cache-dir", "-r", "requirements.txt"], check=True)
     
+    # 将用户二进制目录添加到 PATH
+    os.environ["PATH"] = f"/home/appuser/.local/bin:{os.environ['PATH']}"
+    
     # 启动 FastAPI 服务
     subprocess.run(["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"])