Initial curated RAGcore source from c16667f0c9397e2bfc8dd0255b114fba23c8d05e

Dockerfile

@@ -0,0 +1,82 @@
+# syntax=docker/dockerfile:1.7
+FROM ghcr.io/astral-sh/uv:0.8.24-python3.13-bookworm-slim AS uv-bin
+FROM python:3.13.2-slim-bookworm AS builder
+RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+COPY --from=uv-bin /usr/local/bin/uv /usr/local/bin/uv
+WORKDIR /app
+# Large locked ML wheels can exceed uv's 30-second transfer timeout on a cold
+# clean-room build. Keep resolution locked while allowing slow local/CI links.
+ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_HTTP_TIMEOUT=300
+COPY pyproject.toml README.md ./
+COPY uv.lock ./
+COPY alembic.ini ./
+COPY alembic ./alembic
+COPY src ./src
+COPY sdk ./sdk
+RUN uv sync --locked --no-dev --extra control --extra retrieval --extra web --extra auth --extra telemetry --extra mcp --extra ingestion --no-editable
+# Rich-document (PDF/DOCX/PPTX/XLSX/HTML) parsing needs Docling's layout and
+# table models at runtime; the runtime container is read-only and has no
+# network model store, so bake them into the image and point Docling at them
+# via DOCLING_ARTIFACTS_PATH (set in the runtime stage below).
+# layout + tableformer only: the locked docling-slim install has no easyocr,
+# so OCR for scanned (text-layer-less) PDFs is a documented limitation; a
+# born-digital PDF never needs it.
+RUN /app/.venv/bin/docling-tools models download layout tableformer --output-dir /app/docling-models
+
+FROM python:3.13.2-slim-bookworm AS runtime
+# libgl1/libglib2.0-0/libxcb1: OpenCV (a Docling table-model dependency)
+# links against them; the slim base omits them.
+RUN apt-get update && apt-get upgrade -y \
+  && apt-get install -y --no-install-recommends git libgl1 libglib2.0-0 libxcb1 \
+  && rm -rf /var/lib/apt/lists/*
+RUN groupadd --gid 10001 ragcore && useradd --uid 10001 --gid 10001 --no-create-home ragcore
+WORKDIR /app
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/alembic.ini /app/alembic.ini
+COPY --from=builder /app/alembic /app/alembic
+COPY --from=builder /app/docling-models /app/docling-models
+COPY src ./src
+ENV PATH="/app/.venv/bin:$PATH" PYTHONPATH=/app/src PYTHONUNBUFFERED=1 \
+    DOCLING_ARTIFACTS_PATH=/app/docling-models
+USER 10001:10001
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live', timeout=3)"
+CMD ["uvicorn", "ragcore.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips=*"]
+
+FROM python:3.13.2-slim-bookworm AS ci
+RUN apt-get update && apt-get upgrade -y \
+  && apt-get install -y --no-install-recommends git curl ca-certificates gnupg \
+       libgl1 libglib2.0-0 libxcb1 \
+  && rm -rf /var/lib/apt/lists/*
+# Debian bookworm's own postgresql-client is v15; pg_dump refuses to dump
+# from the project's Postgres 18 server unless its major version matches,
+# so pull the matching client from the official PGDG repository instead.
+RUN install -d /usr/share/postgresql-common/pgdg \
+  && curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail \
+       https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+  && echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
+       > /etc/apt/sources.list.d/pgdg.list \
+  && apt-get update && apt-get install -y --no-install-recommends postgresql-client-18 \
+  && rm -rf /var/lib/apt/lists/*
+COPY --from=uv-bin /usr/local/bin/uv /usr/local/bin/uv
+WORKDIR /workspace
+ENV UV_HTTP_TIMEOUT=300
+COPY pyproject.toml README.md uv.lock ./
+COPY alembic.ini ./
+COPY alembic ./alembic
+COPY src ./src
+COPY sdk ./sdk
+COPY tests ./tests
+COPY scripts ./scripts
+COPY docs ./docs
+COPY evaluation ./evaluation
+COPY examples ./examples
+COPY ops ./ops
+# The same baked Docling models the runtime image ships, so the PDF/DOCX
+# ingestion gates run offline on CI's internal network exactly like the
+# read-only production container does (no model download at conversion time).
+COPY --from=builder /app/docling-models /workspace/docling-models
+RUN uv sync --locked --extra control --extra retrieval --extra web --extra auth --extra telemetry --extra mcp --extra ingestion --group dev
+ENV PATH="/workspace/.venv/bin:$PATH" PYTHONPATH=/workspace/src PYTHONUNBUFFERED=1     DOCLING_ARTIFACTS_PATH=/workspace/docling-models
+CMD ["pytest"]