#314 Fixes: Added multi-architecture Docker build support with uv dependency management - #334
#314 Fixes: Added multi-architecture Docker build support with uv dependency management#334RaghuveeRR07 wants to merge 8 commits into
Conversation
RaghuveeRR07
commented
Sep 2, 2025
RaghuveeRR07
commented
- Replaced COPY --from=ghcr.io/astral-sh/uv:latest with direct pip install uv.
- Installed uv using pip to ensure compatibility across multiple platforms.
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Warning Rate limit exceeded@RaghuveeRR07 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 12 minutes and 45 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughIntroduced a dedicated UV build stage (ARG UV_VERSION default 0.4.28) and changed the Dockerfile to COPY only the Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer / CI
participant Docker as Docker build
participant UVStage as uv build stage
participant Final as Final image
Dev->>Docker: trigger multi-stage build
Docker->>UVStage: pull ghcr.io/astral-sh/uv:${UV_VERSION}@sha256
UVStage-->>Docker: provide /uv binary
Docker->>Final: COPY --from=uv /uv -> /usr/local/bin/uv
Docker->>Final: assemble remaining layers (deps, files, CMD)
Final-->>Dev: built image with pinned base and /usr/local/bin/uv
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @RaghuveeRR07, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request enhances the Docker build process for the state-manager service by modifying how the uv dependency manager is installed. The primary goal is to ensure broader compatibility and robustness for Docker builds across different system architectures.
Highlights
- Docker Build Process: Replaced the
COPY --frominstruction foruvwith a directpip install uvcommand in theDockerfile. - Multi-Architecture Support: This change aims to improve multi-architecture Docker build compatibility by installing
uvviapip, ensuring it works across various platforms.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request updates the Dockerfile to install uv using pip instead of copying it from another image. This is a great improvement as it enhances multi-architecture build support and also pins the uv version, which improves build reproducibility. I've added one suggestion to also upgrade pip as part of the same step, which is a common best practice for ensuring a reliable build environment.
| FROM python:3.12-slim-bookworm | ||
| COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ | ||
|
|
||
| RUN pip install --no-cache-dir uv==0.4.28 |
There was a problem hiding this comment.
It's a good practice to upgrade pip to its latest version before installing packages. This ensures you have the latest features and security fixes. You can combine the upgrade and the uv installation in a single RUN command to keep the number of layers down. Also, it's recommended to run pip as a module (python -m pip) to avoid issues with which pip executable is used.
RUN python -m pip install --upgrade pip && python -m pip install --no-cache-dir uv==0.4.28
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
state-manager/Dockerfile(1 hunks)
🔇 Additional comments (1)
state-manager/Dockerfile (1)
15-15: No issues found with the CMD entrypoint.
Thestate-manager/run.pyfile is included in the Docker build context and will be copied into/api-server/run.py, so theCMD ["uv","run","run.py",…]will succeed.
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
state-manager/Dockerfile (3)
12-12: Harden reproducibility: fail if lock and spec drift.Add --frozen so builds fail on lock/spec mismatch; optionally skip dev deps.
Apply:
-RUN uv sync --locked +RUN uv sync --locked --frozen --no-dev
3-18: Run as non-root and add a basic healthcheck.Addresses CKV_DOCKER_2 and CKV_DOCKER_3; improves security and ops.
Apply:
FROM python:3.12-slim-bookworm +ENV PIP_DISABLE_PIP_VERSION_CHECK=1 PIP_ROOT_USER_ACTION=ignore @@ EXPOSE 8000 +RUN useradd -r -u 10001 -g users appuser && chown -R appuser:users /api-server +USER 10001 +HEALTHCHECK --interval=30s --timeout=3s --retries=3 CMD python -c "import socket,sys; s=socket.socket(); s.settimeout(2); s.connect(('127.0.0.1',8000)); s.close()" || exit 1
18-18: Optional: drop uv at runtime; run via the venv.Reduces attack surface; keep uv only for build.
Apply:
-RUN uv sync --locked +RUN uv sync --locked --frozen --no-dev +ENV VIRTUAL_ENV=/api-server/.venv +ENV PATH="${VIRTUAL_ENV}/bin:${PATH}" @@ -CMD ["uv", "run", "run.py", "--mode", "production", "--workers", "4"] +CMD ["python", "run.py", "--mode", "production", "--workers", "4"]If you take this path, you can also remove the uv copy step entirely.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
state-manager/Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
state-manager/Dockerfile
[LOW] 1-18: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[LOW] 1-18: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🔇 Additional comments (1)
state-manager/Dockerfile (1)
1-6: PR description conflicts with the Dockerfile.Description says “pip install uv”; code copies uv from the ghcr image. Update the PR text or the Dockerfile to match intent.
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
state-manager/Dockerfile (4)
8-16: Run as non-root and preserve ownership on COPY.Create an app user, use COPY --chown, and drop privileges before runtime.
WORKDIR /api-server - -COPY pyproject.toml uv.lock ./ +RUN useradd -r -u 10001 -m -d /home/app app +COPY --chown=app:app pyproject.toml uv.lock ./ RUN uv sync --locked -COPY . . +COPY --chown=app:app . . EXPOSE 8000 + +USER app
12-12: Speed up uv sync with a BuildKit cache mount.Caches uv’s download/build artifacts across builds.
-RUN uv sync --locked +RUN --mount=type=cache,target=/root/.cache/uv uv sync --lockedAdd the directive at the very top of the file to enable mounts:
# syntax=docker/dockerfile:1.7
16-18: Add a basic healthcheck.Improves operability and satisfies CKV_DOCKER_2.
EXPOSE 8000 - -CMD ["uv", "run", "run.py", "--mode", "production", "--workers", "4"] +HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \ + CMD python - <<'PY' || exit 1 +import sys, urllib.request +try: + urllib.request.urlopen("http://127.0.0.1:8000/healthz", timeout=2) +except Exception: + sys.exit(1) +PY +CMD ["uv", "run", "run.py", "--mode", "production", "--workers", "4"]Adjust the health endpoint as appropriate.
4-18: Consider creating a non-root user before copying app files and adding minimal labels.Optional, but aligns with CKV_DOCKER_3 and improves metadata.
FROM python:3.12-slim-bookworm@sha256:<digest> +LABEL org.opencontainers.image.source="https://github.com/exospherehost/exospherehost" \ + org.opencontainers.image.title="state-manager" \ + org.opencontainers.image.version="${UV_VERSION}"
♻️ Duplicate comments (2)
state-manager/Dockerfile (2)
1-2: Nice shift to multi-arch UV with a version ARG.Using a UV stage and exposing UV_VERSION makes bumps easy and preserves multi-arch. Good call.
6-6: Copying only /uv keeps the image slimmer.Good optimization; avoids pulling uvx unnecessarily.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
state-manager/Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
state-manager/Dockerfile
[LOW] 1-18: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[LOW] 1-18: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🔇 Additional comments (1)
state-manager/Dockerfile (1)
1-2: PR description contradicts the implementation (pip vs COPY).The PR text says “pip install uv”, but the Dockerfile copies the uv binary from the uv stage. Please update the PR description or the Dockerfile to match.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
state-manager/Dockerfile (3)
8-12: Leverage BuildKit cache for faster, reproducibleuv sync.If you’re using Dockerfile v1.5+ syntax, cache uv downloads:
- WORKDIR /api-server + WORKDIR /api-server COPY pyproject.toml uv.lock ./ - RUN uv sync --locked + RUN --mount=type=cache,target=/root/.cache/uv uv sync --lockedAdditionally, consider adding the syntax directive at the top of the file (outside this hunk):
# syntax=docker/dockerfile:1.9
8-18: Run as non-root and add a lightweight HEALTHCHECK.Apply:
WORKDIR /api-server COPY pyproject.toml uv.lock ./ RUN uv sync --locked COPY . . EXPOSE 8000 +RUN useradd --system --uid 10001 --create-home app && chown -R app:app /api-server +USER app +# TCP liveness check on 8000 without pulling curl/wget +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ + CMD python -c "import socket,sys; s=socket.create_connection(('127.0.0.1',8000),3); s.close()" CMD ["uv", "run", "run.py", "--mode", "production", "--workers", "4"]
14-14: Add a .dockerignore to exclude unnecessary files from the build context
The repository is missing a .dockerignore, so theCOPY . .in state-manager/Dockerfile (line 14) will include everything—leading to larger images and slower builds. Create a.dockerignoreat the repo root with at least:
- .git
- pycache/
- *.pyc
- node_modules/
- dist/
- build/
- .venv/
- .mypy_cache/
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
state-manager/Dockerfile(1 hunks)
🧰 Additional context used
🪛 Checkov (3.2.334)
state-manager/Dockerfile
[LOW] 1-18: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[LOW] 1-18: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🔇 Additional comments (3)
state-manager/Dockerfile (3)
6-6: Good: copy only uv binary (drop uvx) for a slimmer image.
1-18: PR description is outdated vs. current Dockerfile.Code copies uv from a pinned image; description says “pip install uv”. Update PR text to avoid confusion.
18-18: Entrypoint run.py verified for non-root execution. run.py is present in/api-server, binds to port 8000 (non-privileged) and is loaded byuv run(no executable bit required).
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
| ARG UV_VERSION=0.4.28 | ||
| ARG UV_DIGEST=sha256:REPLACE_WITH_MANIFEST_DIGEST | ||
| FROM ghcr.io/astral-sh/uv:${UV_VERSION}@${UV_DIGEST} AS uv | ||
| ARG PYTHON_DIGEST=sha256:REPLACE_WITH_MANIFEST_DIGEST | ||
| FROM python:3.12-slim-bookworm@${PYTHON_DIGEST} | ||
|
|
||
| COPY --from=uv /uv /usr/local/bin/uv |
There was a problem hiding this comment.
@RaghuveeRR07 I do not understand why the earlier implementation was not working but current one is
There was a problem hiding this comment.
can you please explain more ?
There was a problem hiding this comment.
The earlier implementation had the latest tag due to which the manifest files for some architecture like armv7 did not exist. this was one of the error I encountered buildx error: “no match for platform in manifest”.
Manifest file is a just a JSON file, which has info about which image is suitable for which arch.
This is the only change I implemented because when I even tried pushing the image of docker hub, armv7 failed. So I understood there is need to specify the version while installing uv.
All the other changes were suggested by this codeReview bot, so I am not really sure what the "digest" tag does.
2 participants
