From 024abf07a83f1b2b51b4889e0db0e55027d1d7b5 Mon Sep 17 00:00:00 2001
From: Huarch <huarch97@outlook.com>
Date: Thu, 22 Oct 2026 11:54:07 +0800
Subject: [PATCH] chore(docker): pin secure runtime and resolve MCP
 dependencies

---
 Dockerfile                      |  9 ++++++---
 infra/docker/docker-compose.yml | 24 +++++-------------------
 requirements.txt                |  2 +-
 3 files changed, 12 insertions(+), 23 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ceb265f..7e13133 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,16 @@
-FROM condaforge/miniforge3:latest AS base
+FROM condaforge/miniforge3:26.7.2-0@sha256:569afc65b5338d35e276adf9a860025cd37a677659d19dcb71fc1d4c2063a94e AS base
 
 WORKDIR /app
 
+ENV CONDA_ENV_PATH=/opt/server \
+    PATH="/opt/server/bin:${PATH}"
+
 ENV PIP_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple \
     PIP_TRUSTED_HOST=pypi.tuna.tsinghua.edu.cn \
     UV_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
 
-# 安装 Python 3.12 和 pymetis (通过 conda-forge 避免编译问题)
-RUN mamba install -y python=3.12 pymetis && \
+# 在独立环境中安装 Python 3.12 和 pymetis，避免修改 Miniforge 基础环境。
+RUN mamba create -y -p "$CONDA_ENV_PATH" python=3.12 pymetis pip && \
     mamba clean -afy
 
 COPY requirements.txt .
diff --git a/infra/docker/docker-compose.yml b/infra/docker/docker-compose.yml
index 23e5515..aca7ca7 100644
--- a/infra/docker/docker-compose.yml
+++ b/infra/docker/docker-compose.yml
@@ -27,7 +27,7 @@ services:
 
   # --- Keycloak ---
   keycloakDB:
-    image: postgis/postgis:14-3.5
+    image: postgis/postgis:14-3.5@sha256:2543ae2bc9497ca62cd740268be228f7a6974020207634e2b189fe36be82b749
     container_name: keycloakDB
     restart: always
     environment:
@@ -41,7 +41,7 @@ services:
       - ./keycloak/db_data:/var/lib/postgresql/data
 
   keycloak:
-    image: keycloak/keycloak:latest
+    image: keycloak/keycloak:26.8.1@sha256:79c623a22abacf3fe6c00a5fb30f5b7843d717b234033b80995891c06116d244
     container_name: keycloak
     restart: always
     environment:
@@ -69,7 +69,7 @@ services:
     depends_on:
       - keycloakDB
 
-  # --- TimescaleDB & Grafana ---
+  # --- TimescaleDB ---
   timescaledb:
     image: timescale/timescaledb:latest-pg15
     container_name: timescaledb
@@ -83,23 +83,9 @@ services:
     volumes:
       - ./timescaledb/data:/var/lib/postgresql/data
 
-  grafana:
-    image: grafana/grafana:latest
-    container_name: grafana
-    restart: always
-    ports:
-      - "${GRAFANA_PORT}:3000"
-    depends_on:
-      - timescaledb
-    volumes:
-      - ./timescaledb/grafana_data:/var/lib/grafana
-    environment:
-      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
-
   # --- MapService (PostGIS & GeoServer) ---
   postgis:
-    image: postgis/postgis:14-3.5
+    image: postgis/postgis:14-3.5@sha256:2543ae2bc9497ca62cd740268be228f7a6974020207634e2b189fe36be82b749
     container_name: postgis
     restart: always
     environment:
@@ -124,7 +110,7 @@ services:
       - ./mapservice/data:/var/lib/postgresql/data
 
   geoserver:
-    image: docker.osgeo.org/geoserver:2.27.1
+    image: docker.osgeo.org/geoserver:2.28.5@sha256:c6a3f3ef32c8b39e8a93ef54346cbe62f212ed27f1c49c3ff51cbae5a9b70e84
     container_name: geoserver
     restart: always
     ports:
diff --git a/requirements.txt b/requirements.txt
index 78e2908..d7ca268 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -39,7 +39,7 @@ h11==0.16.0
 httpcore==1.0.9
 httpx==0.28.1
 httpx-sse==0.4.3
-idna==3.10
+idna==3.20
 importlib_metadata==8.7.1
 iniconfig==2.0.0
 jaraco.classes==3.4.0