Dockerfile.gitlab

# syntax=docker/dockerfile:1.7
# GitLab's protected shared runner is intentionally unprivileged. Its console job builds and
# tests the SPA first; this daemonless chroot/VFS gate then assembles the same final Python
# runtime boundary without attempting Docker-in-Docker or rebuilding the large Node layer.

FROM python:3.12.11-slim-bookworm AS wheel-build

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /build
COPY pyproject.toml ./
COPY src ./src
RUN python -m pip wheel --wheel-dir /wheels .


FROM python:3.12.11-slim-bookworm AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /app

RUN groupadd --system app \
    && useradd --system --gid app --home-dir /app --no-create-home app

COPY --from=wheel-build /wheels /wheels
RUN python -m pip install --no-index --find-links=/wheels agentforge==0.1.0 \
    && rm -rf /wheels

COPY alembic.ini /app/alembic.ini
COPY migrations /app/migrations
COPY evals /app/evals
COPY --chown=app:app scripts/verify_langfuse_campaign.py /app/scripts/verify_langfuse_campaign.py
COPY --chown=app:app console/dist /app/console

RUN chown -R app:app /app
USER app

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD ["python", "-c", "import os, urllib.request; urllib.request.urlopen('http://127.0.0.1:' + os.environ.get('PORT', '8000') + '/health', timeout=2).read()"]

CMD ["python", "-m", "agentforge.web"]