55 lines
2.7 KiB
Docker
55 lines
2.7 KiB
Docker
FROM python:3.12-alpine3.23@sha256:31a768b01976652c222e318fe5bd6e7c252f056cbf489c88fa256f1bf0af58e3
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
# PostgreSQL 17 client tools. ModelForge owns its own consistent logical backup and restore and
|
|
# must never fall back to copying a live data directory, so pg_dump/pg_restore/psql ship with the
|
|
# control plane and are pinned to the same major version as the server. Upgrade the signed Alpine
|
|
# repository packages during the build so a digest-pinned base does not retain already-fixed CVEs.
|
|
ARG POSTGRES_MAJOR=17
|
|
RUN set -eux; \
|
|
apk upgrade --no-cache; \
|
|
apk add --no-cache ca-certificates "postgresql${POSTGRES_MAJOR}-client"
|
|
|
|
# Build identity. These are stamped in at build time so a running container can say exactly
|
|
# where it came from; an argument that is never passed stays empty and is reported as null
|
|
# rather than becoming a claimed commit.
|
|
ARG MODELFORGE_VERSION=0.0.0
|
|
ARG MODELFORGE_COMMIT=""
|
|
ARG MODELFORGE_BUILT_AT=""
|
|
ENV MODELFORGE_BUILD_COMMIT=${MODELFORGE_COMMIT}
|
|
ENV MODELFORGE_BUILD_TIMESTAMP=${MODELFORGE_BUILT_AT}
|
|
LABEL org.opencontainers.image.title="ITWorx ModelForge control plane"
|
|
LABEL org.opencontainers.image.description="Capability-first local AI ModelOps and GPU control plane"
|
|
LABEL org.opencontainers.image.version="${MODELFORGE_VERSION}"
|
|
LABEL org.opencontainers.image.revision="${MODELFORGE_COMMIT}"
|
|
LABEL org.opencontainers.image.created="${MODELFORGE_BUILT_AT}"
|
|
LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge"
|
|
LABEL org.opencontainers.image.vendor="ITWorx"
|
|
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
|
|
|
WORKDIR /app
|
|
COPY config/security/build-toolchain.lock /tmp/modelforge-build-toolchain.lock
|
|
COPY backend/pyproject.toml ./
|
|
COPY backend/src ./src
|
|
COPY backend/alembic.ini ./
|
|
COPY backend/alembic ./alembic
|
|
# Build tooling is preinstalled from a fully resolved hash lock. Disabling PEP 517 isolation
|
|
# makes pip use those exact tools rather than fetching a second, unverified build environment.
|
|
RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: \
|
|
--index-url https://pypi.org/simple -r /tmp/modelforge-build-toolchain.lock \
|
|
&& python -m pip install --no-cache-dir --no-build-isolation . \
|
|
&& pip check \
|
|
&& python -m pip uninstall --yes pip setuptools wheel editables hatchling pathspec pluggy \
|
|
tomlkit trove-classifiers
|
|
|
|
RUN addgroup -S modelforge && adduser -S -G modelforge -h /app modelforge \
|
|
&& mkdir -p /data/state /data/hf-cache /data/artifacts /data/quarantine \
|
|
/data/backups /data/restore \
|
|
&& chown -R modelforge:modelforge /app /data
|
|
USER modelforge
|
|
|
|
EXPOSE 8000
|
|
CMD ["uvicorn", "modelforge_api.main:app", "--host", "0.0.0.0", "--port", "8000", "--no-proxy-headers"]
|