Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/Dockerfile

@@ -25,22 +25,24 @@ LABEL org.opencontainers.image.description="Capability-first local AI ModelOps a
 LABEL org.opencontainers.image.version="${MODELFORGE_VERSION}"
 LABEL org.opencontainers.image.revision="${MODELFORGE_COMMIT}"
 LABEL org.opencontainers.image.created="${MODELFORGE_BUILT_AT}"
-LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge.git"
+LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge"
 LABEL org.opencontainers.image.vendor="ITWorx"
 LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
 
 WORKDIR /app
-COPY pyproject.toml ./
-COPY src ./src
-COPY alembic.ini ./
-COPY alembic ./alembic
-# Upgrade the installer before it resolves anything: the pinned base image ships a pip
-# carrying archive-extraction advisories. pip never runs at runtime, but a release image
-# should not carry a known-vulnerable installer.
-RUN pip install --no-cache-dir --upgrade pip "setuptools>=78.1.1" "msgpack>=1.2.1" \
-    && pip install --no-cache-dir . \
+COPY config/security/build-toolchain.lock /tmp/modelforge-build-toolchain.lock
+COPY backend/pyproject.toml ./
+COPY backend/src ./src
+COPY backend/alembic.ini ./
+COPY backend/alembic ./alembic
+# Build tooling is preinstalled from a fully resolved hash lock. Disabling PEP 517 isolation
+# makes pip use those exact tools rather than fetching a second, unverified build environment.
+RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: \
+        --index-url https://pypi.org/simple -r /tmp/modelforge-build-toolchain.lock \
+    && python -m pip install --no-cache-dir --no-build-isolation . \
     && pip check \
-    && python -m pip uninstall --yes pip setuptools
+    && python -m pip uninstall --yes pip setuptools wheel editables hatchling pathspec pluggy \
+        tomlkit trove-classifiers
 
 RUN addgroup -S modelforge && adduser -S -G modelforge -h /app modelforge \
     && mkdir -p /data/state /data/hf-cache /data/artifacts /data/quarantine \
@@ -49,4 +51,4 @@ RUN addgroup -S modelforge && adduser -S -G modelforge -h /app modelforge \
 USER modelforge
 
 EXPOSE 8000
-CMD ["uvicorn", "modelforge_api.main:app", "--host", "0.0.0.0", "--port", "8000"]
+CMD ["uvicorn", "modelforge_api.main:app", "--host", "0.0.0.0", "--port", "8000", "--no-proxy-headers"]