sheaf/Dockerfile.backend at main · sheaf-project/sheaf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
FROM python:3.12-slim AS base

WORKDIR /app

RUN addgroup --system sheaf && adduser --system --ingroup sheaf sheaf

# Copy source first — hatchling needs the package dir to build
COPY pyproject.toml .
COPY sheaf/ sheaf/
COPY alembic.ini .
COPY alembic/ alembic/

# Optional pip index overrides. Empty by default so public builds use
# PyPI as-is; selfhosters can point at a private mirror or cache by
# passing `--build-arg PIP_INDEX_URL=...` (or via docker-compose args
# forwarded from .env). pip reads these env vars natively.
ARG PIP_INDEX_URL=
ARG PIP_EXTRA_INDEX_URL=
ENV PIP_INDEX_URL=${PIP_INDEX_URL}
ENV PIP_EXTRA_INDEX_URL=${PIP_EXTRA_INDEX_URL}

RUN pip install --no-cache-dir ".[s3,ses,smtp,sendgrid]"

# Dev-only tools (destructive jobs for demo instances, etc.)
# Only installed when INCLUDE_DEV_TOOLS=true. Default: not installed,
# so production images physically cannot contain this code.
ARG INCLUDE_DEV_TOOLS=false
COPY sheaf_dev/ sheaf_dev/
RUN if [ "$INCLUDE_DEV_TOOLS" = "true" ]; then \
      pip install --no-cache-dir ./sheaf_dev; \
    fi && rm -rf sheaf_dev/

RUN mkdir -p /app/data && chown sheaf:sheaf /app/data
# Multi-process Prometheus mmap directory. The entrypoint wipes stale
# files before uvicorn starts so a previous container's leftover
# values can't resurrect into a fresh deploy. Created world-writable
# because uvicorn workers spawned under uid:gid sheaf:sheaf write here.
RUN mkdir -p /var/run/prometheus-multiproc && chown sheaf:sheaf /var/run/prometheus-multiproc
ENV PROMETHEUS_MULTIPROC_DIR=/var/run/prometheus-multiproc

# Build provenance — populated by CI (or `docker build --build-arg`).
# Late in the file so the heavyweight pip-install cache layer survives
# unrelated commit changes.
ARG GIT_COMMIT=
ARG GIT_TAG=
ARG BUILD_TIME=
ENV SHEAF_GIT_COMMIT=${GIT_COMMIT}
ENV SHEAF_GIT_TAG=${GIT_TAG}
ENV SHEAF_BUILD_TIME=${BUILD_TIME}
LABEL org.opencontainers.image.revision=${GIT_COMMIT}
LABEL org.opencontainers.image.version=${GIT_TAG}
LABEL org.opencontainers.image.source=https://github.com/sheaf-project/sheaf

USER sheaf

EXPOSE 8000 8090

CMD ["sh", "-c", "rm -f \"$PROMETHEUS_MULTIPROC_DIR\"/*.db && alembic upgrade head && uvicorn sheaf.main:app --host 0.0.0.0 --port ${SHEAF_PORT:-8000} --proxy-headers --forwarded-allow-ips=\"${FORWARDED_ALLOW_IPS:-127.0.0.1}\""]