FROM pytorch/pytorch:2.7.1-cuda12.8-cudnn9-runtime@sha256:c16f4c749e2d9e96878875cdf6cc45cddda1d1a36fddd371dd6f2360f1b6e2a2

ARG MODELFORGE_VERSION=0.0.0
ARG MODELFORGE_COMMIT=""
ARG MODELFORGE_BUILT_AT=""
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    MODELFORGE_BUILD_COMMIT=${MODELFORGE_COMMIT} \
    MODELFORGE_BUILD_TIMESTAMP=${MODELFORGE_BUILT_AT} \
    HF_HUB_OFFLINE=1 \
    TRANSFORMERS_OFFLINE=1 \
    HF_DATASETS_OFFLINE=1 \
    TOKENIZERS_PARALLELISM=false \
    HF_HOME=/tmp/huggingface

LABEL org.opencontainers.image.title="ITWorx ModelForge runtime worker"
LABEL org.opencontainers.image.description="Private typed model runtime for ITWorx ModelForge"
LABEL org.opencontainers.image.version="${MODELFORGE_VERSION}"
LABEL org.opencontainers.image.revision="${MODELFORGE_COMMIT}"
LABEL org.opencontainers.image.created="${MODELFORGE_BUILT_AT}"
LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge"
LABEL org.opencontainers.image.vendor="ITWorx"
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"

WORKDIR /build
COPY config/security/build-toolchain.lock /tmp/modelforge-build-toolchain.lock
COPY runtime-worker ./runtime-worker
RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: \
        --index-url https://pypi.org/simple -r /tmp/modelforge-build-toolchain.lock \
    && apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get upgrade --yes \
    && python -m pip install --no-cache-dir --no-build-isolation './runtime-worker[inference]' \
    && DEBIAN_FRONTEND=noninteractive apt-get purge --yes linux-libc-dev \
    && rm -rf /var/lib/apt/lists/* \
    && pip check \
    && python -m pip uninstall --yes pip setuptools wheel editables hatchling pathspec pluggy \
        tomlkit trove-classifiers \
    # This is the only shared group: it grants the worker read-only access to the Node Agent's
    # 0640 node credential in the project-scoped, read-only state volume.
    && groupadd --system --gid 101 modelforge-agent \
    && groupadd --system modelforge-runtime \
    && useradd --system --gid modelforge-runtime --groups modelforge-agent --home /app modelforge-runtime \
    && mkdir -p /app /tmp/huggingface \
    && chown -R modelforge-runtime:modelforge-runtime /app /tmp/huggingface

USER modelforge-runtime
WORKDIR /app
CMD ["modelforge-runtime-worker"]