90 lines
2.5 KiB
Docker
90 lines
2.5 KiB
Docker
# Two-stage Dockerfile for EmbeddingBuddy
|
|
# Stage 1: Builder
|
|
FROM python:3.11-slim as builder
|
|
|
|
# Create non-root user early in builder stage
|
|
RUN groupadd -r appuser && useradd -r -g appuser appuser
|
|
|
|
# Install system dependencies for building Python packages
|
|
RUN apt-get update && apt-get install -y \
|
|
build-essential \
|
|
gcc \
|
|
g++ \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install uv for dependency management
|
|
RUN pip install uv
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy dependency files
|
|
COPY pyproject.toml uv.lock ./
|
|
|
|
# Copy source code (needed for editable install)
|
|
COPY src/ src/
|
|
COPY main.py .
|
|
COPY wsgi.py .
|
|
COPY run_prod.py .
|
|
COPY assets/ assets/
|
|
|
|
# Change ownership of source files before building (lighter I/O)
|
|
RUN chown -R appuser:appuser /app
|
|
|
|
# Create and set permissions for appuser home directory (needed for uv cache)
|
|
RUN mkdir -p /home/appuser && chown -R appuser:appuser /home/appuser
|
|
|
|
# Switch to non-root user before building
|
|
USER appuser
|
|
|
|
# Create virtual environment and install dependencies (including production extras)
|
|
RUN uv venv .venv
|
|
RUN uv sync --frozen --extra prod
|
|
|
|
# Stage 2: Runtime
|
|
FROM python:3.11-slim as runtime
|
|
|
|
# Create non-root user in runtime stage
|
|
RUN groupadd -r appuser && useradd -r -g appuser appuser
|
|
|
|
# Install runtime dependencies for compiled packages
|
|
RUN apt-get update && apt-get install -y \
|
|
libgomp1 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Set working directory and change ownership (small directory)
|
|
WORKDIR /app
|
|
RUN chown appuser:appuser /app
|
|
|
|
# Copy files from builder with correct ownership
|
|
COPY --from=builder --chown=appuser:appuser /app/.venv /app/.venv
|
|
COPY --from=builder --chown=appuser:appuser /app/src /app/src
|
|
COPY --from=builder --chown=appuser:appuser /app/main.py /app/main.py
|
|
COPY --from=builder --chown=appuser:appuser /app/assets /app/assets
|
|
COPY --from=builder --chown=appuser:appuser /app/wsgi.py /app/wsgi.py
|
|
COPY --from=builder --chown=appuser:appuser /app/run_prod.py /app/run_prod.py
|
|
|
|
# Switch to non-root user
|
|
USER appuser
|
|
|
|
# Make sure the virtual environment is in PATH
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
# Set Python path
|
|
ENV PYTHONPATH="/app/src:$PYTHONPATH"
|
|
|
|
# Environment variables for production
|
|
ENV EMBEDDINGBUDDY_HOST=0.0.0.0
|
|
ENV EMBEDDINGBUDDY_PORT=8050
|
|
ENV EMBEDDINGBUDDY_DEBUG=false
|
|
ENV EMBEDDINGBUDDY_ENV=production
|
|
|
|
# Expose port
|
|
EXPOSE 8050
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
|
|
CMD python -c "import requests; requests.get('http://localhost:8050/', timeout=5)" || exit 1
|
|
|
|
# Run application with Gunicorn in production
|
|
CMD ["python", "run_prod.py"] |