Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

runtime-worker/Dockerfile

@@ -18,20 +18,28 @@ LABEL org.opencontainers.image.description="Private typed model runtime for ITWo
 LABEL org.opencontainers.image.version="${MODELFORGE_VERSION}"
 LABEL org.opencontainers.image.revision="${MODELFORGE_COMMIT}"
 LABEL org.opencontainers.image.created="${MODELFORGE_BUILT_AT}"
-LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge.git"
+LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge"
 LABEL org.opencontainers.image.vendor="ITWorx"
 LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
 
 WORKDIR /build
+COPY config/security/build-toolchain.lock /tmp/modelforge-build-toolchain.lock
 COPY runtime-worker ./runtime-worker
-RUN apt-get update \
+RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: \
+        --index-url https://pypi.org/simple -r /tmp/modelforge-build-toolchain.lock \
+    && apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get upgrade --yes \
-    && pip install --no-cache-dir './runtime-worker[inference]' \
+    && python -m pip install --no-cache-dir --no-build-isolation './runtime-worker[inference]' \
     && DEBIAN_FRONTEND=noninteractive apt-get purge --yes linux-libc-dev \
     && rm -rf /var/lib/apt/lists/* \
     && pip check \
+    && python -m pip uninstall --yes pip setuptools wheel editables hatchling pathspec pluggy \
+        tomlkit trove-classifiers \
+    # This is the only shared group: it grants the worker read-only access to the Node Agent's
+    # 0640 node credential in the project-scoped, read-only state volume.
+    && groupadd --system --gid 101 modelforge-agent \
     && groupadd --system modelforge-runtime \
-    && useradd --system --gid modelforge-runtime --home /app modelforge-runtime \
+    && useradd --system --gid modelforge-runtime --groups modelforge-agent --home /app modelforge-runtime \
     && mkdir -p /app /tmp/huggingface \
     && chown -R modelforge-runtime:modelforge-runtime /app /tmp/huggingface