89 lines
3.8 KiB
Docker
89 lines
3.8 KiB
Docker
|
# uj-mastering-master — web UI
|
||
|
|
#
|
||
|
|
# Multi-stage on purpose: the build stage compiles wheels (librosa pulls in
|
||
|
|
# scipy, numba and llvmlite, all of which have C extensions), and none of that
|
||
|
|
# toolchain belongs in the runtime image.
|
||
|
|
#
|
||
|
|
# The runtime image installs the *installed package*, not a source tree, so the
|
||
|
|
# same image works whether you built it from a checkout or a release tarball.
|
||
|
|
#
|
||
|
|
# Note on audio: the web UI stores uploaded audio in the browser (OPFS) and
|
||
|
|
# spools each request body to /tmp only for the duration of that request. There
|
||
|
|
# is no volume for audio, because the app never keeps any — see README.
|
||
|
|
#
|
||
|
|
# Note on the desktop app: this image is the *web* front end only. PyQt5 and
|
||
|
|
# pyqtgraph are deliberately not installed — there is no display in a container.
|
||
|
|
|
||
|
|
# ---- build -----------------------------------------------------------------
|
||
|
|
FROM python:3.11-slim AS build
|
||
|
|
|
||
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
||
|
|
PIP_NO_CACHE_DIR=1 \
|
||
|
|
UV_LINK_MODE=copy
|
||
|
|
|
||
|
|
# numba/llvmlite and scipy need a compiler; libsndfile is what soundfile
|
||
|
|
# (librosa's decoder) links against at runtime, but the wheel needs it at build
|
||
|
|
# time to be detected.
|
||
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
|
|
build-essential \
|
||
|
|
&& rm -rf /var/lib/apt/lists/*
|
||
|
|
|
||
|
|
COPY --from=ghcr.io/astral-sh/uv:0.12.5 /uv /usr/local/bin/uv
|
||
|
|
|
||
|
|
WORKDIR /src
|
||
|
|
# Copy the whole checkout minus .dockerignore. Deliberately not a hand-picked
|
||
|
|
# file list: `py-modules` in pyproject.toml enumerates every module the build
|
||
|
|
# backend must find, and a curated COPY that omits any of them fails the build
|
||
|
|
# with "file <module>.py not found". The exclusions that matter (venv, caches,
|
||
|
|
# .git, local state) are in .dockerignore, which is the right place for them.
|
||
|
|
COPY . .
|
||
|
|
|
||
|
|
# Build a wheel, then install it into a self-contained prefix to copy forward.
|
||
|
|
# `"uj-mastering-master[web]"` (not `--extra web`) is the syntax uv wants when
|
||
|
|
# installing a source tree — `--extra` needs a lockfile/setup.py it does not
|
||
|
|
# have here and fails with "Requesting extras requires a pylock.toml...".
|
||
|
|
RUN uv venv /opt/venv \
|
||
|
|
&& uv pip install --python /opt/venv/bin/python --no-cache \
|
||
|
|
".[web]"
|
||
|
|
|
||
|
|
# ---- runtime ---------------------------------------------------------------
|
||
|
|
FROM python:3.11-slim AS runtime
|
||
|
|
|
||
|
|
# libsndfile1 is the only runtime system dependency: librosa decodes through
|
||
|
|
# soundfile, which dlopens it. Everything else is a self-contained wheel.
|
||
|
|
# (FFmpeg is *not* needed — it only ever generated test fixtures.)
|
||
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||
|
|
libsndfile1 \
|
||
|
|
&& rm -rf /var/lib/apt/lists/*
|
||
|
|
|
||
|
|
# Non-root, with a home it can actually write to: librosa/numba want a cache
|
||
|
|
# dir, and the app spools request bodies under /tmp.
|
||
|
|
RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin ujm
|
||
|
|
|
||
|
|
COPY --from=build /opt/venv /opt/venv
|
||
|
|
|
||
|
|
ENV PATH=/opt/venv/bin:$PATH \
|
||
|
|
PYTHONUNBUFFERED=1 \
|
||
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
||
|
|
HOME=/home/ujm \
|
||
|
|
NUMBA_CACHE_DIR=/tmp/numba-cache \
|
||
|
|
MPLCONFIGDIR=/tmp/matplotlib
|
||
|
|
|
||
|
|
# The app's temporary spools land here. Declared so a read-only root filesystem
|
||
|
|
# can still be used (`read_only: true` + `tmpfs: /tmp` in compose).
|
||
|
|
VOLUME ["/tmp"]
|
||
|
|
|
||
|
|
USER ujm
|
||
|
|
WORKDIR /home/ujm
|
||
|
|
|
||
|
|
EXPOSE 8000
|
||
|
|
|
||
|
|
# Baked-in healthcheck: hit the API rather than the page, so it fails when the
|
||
|
|
# *backend* is broken and not merely when a static asset is missing.
|
||
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
||
|
|
CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/metrics', timeout=4).status == 200 else 1)"]
|
||
|
|
|
||
|
|
# 0.0.0.0, not the CLI default of 127.0.0.1: loopback inside a container is
|
||
|
|
# unreachable from the host, which is the whole point of publishing a port.
|
||
|
|
CMD ["ujm-web", "--host", "0.0.0.0", "--port", "8000", "--log-level", "INFO"]
|