# syntax=docker/dockerfile:1.7
FROM ghcr.io/astral-sh/uv:0.8.24-python3.13-bookworm-slim AS uv-bin
FROM python:3.13.2-slim-bookworm AS builder
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
COPY --from=uv-bin /usr/local/bin/uv /usr/local/bin/uv
WORKDIR /app
# Large locked ML wheels can exceed uv's 30-second transfer timeout on a cold
# clean-room build. Keep resolution locked while allowing slow local/CI links.
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_HTTP_TIMEOUT=300
COPY pyproject.toml README.md ./
COPY uv.lock ./
COPY alembic.ini ./
COPY alembic ./alembic
COPY src ./src
COPY sdk ./sdk
RUN uv sync --locked --no-dev --extra control --extra retrieval --extra web --extra auth --extra telemetry --extra mcp --extra ingestion --no-editable
# Rich-document (PDF/DOCX/PPTX/XLSX/HTML) parsing needs Docling's layout and
# table models at runtime; the runtime container is read-only and has no
# network model store, so bake them into the image and point Docling at them
# via DOCLING_ARTIFACTS_PATH (set in the runtime stage below).
# layout + tableformer only: the locked docling-slim install has no easyocr,
# so OCR for scanned (text-layer-less) PDFs is a documented limitation; a
# born-digital PDF never needs it.
RUN /app/.venv/bin/docling-tools models download layout tableformer --output-dir /app/docling-models

FROM python:3.13.2-slim-bookworm AS runtime
# libgl1/libglib2.0-0/libxcb1: OpenCV (a Docling table-model dependency)
# links against them; the slim base omits them.
RUN apt-get update && apt-get upgrade -y \
  && apt-get install -y --no-install-recommends git libgl1 libglib2.0-0 libxcb1 \
  && rm -rf /var/lib/apt/lists/*
RUN groupadd --gid 10001 ragcore && useradd --uid 10001 --gid 10001 --no-create-home ragcore
WORKDIR /app
COPY --from=builder /app/.venv /app/.venv
COPY --from=builder /app/alembic.ini /app/alembic.ini
COPY --from=builder /app/alembic /app/alembic
COPY --from=builder /app/docling-models /app/docling-models
COPY src ./src
ENV PATH="/app/.venv/bin:$PATH" PYTHONPATH=/app/src PYTHONUNBUFFERED=1 \
    DOCLING_ARTIFACTS_PATH=/app/docling-models
USER 10001:10001
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live', timeout=3)"
CMD ["uvicorn", "ragcore.main:app", "--host", "0.0.0.0", "--port", "8080", "--proxy-headers", "--forwarded-allow-ips=*"]

FROM python:3.13.2-slim-bookworm AS ci
RUN apt-get update && apt-get upgrade -y \
  && apt-get install -y --no-install-recommends git curl ca-certificates gnupg \
       libgl1 libglib2.0-0 libxcb1 \
  && rm -rf /var/lib/apt/lists/*
# Debian bookworm's own postgresql-client is v15; pg_dump refuses to dump
# from the project's Postgres 18 server unless its major version matches,
# so pull the matching client from the official PGDG repository instead.
RUN install -d /usr/share/postgresql-common/pgdg \
  && curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail \
       https://www.postgresql.org/media/keys/ACCC4CF8.asc \
  && echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
       > /etc/apt/sources.list.d/pgdg.list \
  && apt-get update && apt-get install -y --no-install-recommends postgresql-client-18 \
  && rm -rf /var/lib/apt/lists/*
COPY --from=uv-bin /usr/local/bin/uv /usr/local/bin/uv
WORKDIR /workspace
ENV UV_HTTP_TIMEOUT=300
COPY pyproject.toml README.md uv.lock ./
COPY alembic.ini ./
COPY alembic ./alembic
COPY src ./src
COPY sdk ./sdk
COPY tests ./tests
COPY scripts ./scripts
COPY docs ./docs
COPY evaluation ./evaluation
COPY examples ./examples
COPY ops ./ops
# The same baked Docling models the runtime image ships, so the PDF/DOCX
# ingestion gates run offline on CI's internal network exactly like the
# read-only production container does (no model download at conversion time).
COPY --from=builder /app/docling-models /workspace/docling-models
RUN uv sync --locked --extra control --extra retrieval --extra web --extra auth --extra telemetry --extra mcp --extra ingestion --group dev
ENV PATH="/workspace/.venv/bin:$PATH" PYTHONPATH=/workspace/src PYTHONUNBUFFERED=1     DOCLING_ARTIFACTS_PATH=/workspace/docling-models
CMD ["pytest"]