53 lines
2.5 KiB
Docker
53 lines
2.5 KiB
Docker
FROM python:3.12-alpine3.23@sha256:31a768b01976652c222e318fe5bd6e7c252f056cbf489c88fa256f1bf0af58e3
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
# PostgreSQL 17 client tools. ModelForge owns its own consistent logical backup and restore and
|
|
# must never fall back to copying a live data directory, so pg_dump/pg_restore/psql ship with the
|
|
# control plane and are pinned to the same major version as the server. Upgrade the signed Alpine
|
|
# repository packages during the build so a digest-pinned base does not retain already-fixed CVEs.
|
|
ARG POSTGRES_MAJOR=17
|
|
RUN set -eux; \
|
|
apk upgrade --no-cache; \
|
|
apk add --no-cache ca-certificates "postgresql${POSTGRES_MAJOR}-client"
|
|
|
|
# Build identity. These are stamped in at build time so a running container can say exactly
|
|
# where it came from; an argument that is never passed stays empty and is reported as null
|
|
# rather than becoming a claimed commit.
|
|
ARG MODELFORGE_VERSION=0.0.0
|
|
ARG MODELFORGE_COMMIT=""
|
|
ARG MODELFORGE_BUILT_AT=""
|
|
ENV MODELFORGE_BUILD_COMMIT=${MODELFORGE_COMMIT}
|
|
ENV MODELFORGE_BUILD_TIMESTAMP=${MODELFORGE_BUILT_AT}
|
|
LABEL org.opencontainers.image.title="ITWorx ModelForge control plane"
|
|
LABEL org.opencontainers.image.description="Capability-first local AI ModelOps and GPU control plane"
|
|
LABEL org.opencontainers.image.version="${MODELFORGE_VERSION}"
|
|
LABEL org.opencontainers.image.revision="${MODELFORGE_COMMIT}"
|
|
LABEL org.opencontainers.image.created="${MODELFORGE_BUILT_AT}"
|
|
LABEL org.opencontainers.image.source="https://git.example.com/example/modelforge.git"
|
|
LABEL org.opencontainers.image.vendor="ITWorx"
|
|
LABEL org.opencontainers.image.licenses="AGPL-3.0-or-later"
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml ./
|
|
COPY src ./src
|
|
COPY alembic.ini ./
|
|
COPY alembic ./alembic
|
|
# Upgrade the installer before it resolves anything: the pinned base image ships a pip
|
|
# carrying archive-extraction advisories. pip never runs at runtime, but a release image
|
|
# should not carry a known-vulnerable installer.
|
|
RUN pip install --no-cache-dir --upgrade pip "setuptools>=78.1.1" "msgpack>=1.2.1" \
|
|
&& pip install --no-cache-dir . \
|
|
&& pip check \
|
|
&& python -m pip uninstall --yes pip setuptools
|
|
|
|
RUN addgroup -S modelforge && adduser -S -G modelforge -h /app modelforge \
|
|
&& mkdir -p /data/state /data/hf-cache /data/artifacts /data/quarantine \
|
|
/data/backups /data/restore \
|
|
&& chown -R modelforge:modelforge /app /data
|
|
USER modelforge
|
|
|
|
EXPOSE 8000
|
|
CMD ["uvicorn", "modelforge_api.main:app", "--host", "0.0.0.0", "--port", "8000"]
|