open-resource-broker/Dockerfile at main · awslabs/open-resource-broker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# Optimized single-stage Dockerfile using pre-built wheel
# Multi-architecture compatible with minimal layers

ARG PYTHON_VERSION=3.13
ARG PACKAGE_NAME_SHORT=orb

FROM python:${PYTHON_VERSION}-slim

ARG PYTHON_VERSION=3.13
ARG PACKAGE_NAME_SHORT=orb

# Apply all available security patches and upgrade Python toolchain
RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        ca-certificates=20250419 && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* && \
    pip install --no-cache-dir --upgrade pip setuptools wheel
ARG BUILD_DATE
ARG VERSION=dev
ARG VCS_REF
ARG AUTHOR
ARG LICENSE
ARG REPO_URL

# Add metadata labels and set environment variables in single layer
LABEL org.opencontainers.image.title="Open Resource Broker API" \
      org.opencontainers.image.description="REST API for Open Resource Broker - Dynamic cloud resource provisioning" \
      org.opencontainers.image.source="${REPO_URL}" \
      org.opencontainers.image.version="${VERSION}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.vendor="${AUTHOR}" \
      org.opencontainers.image.licenses="${LICENSE}"

# Set build info as environment variables for runtime access
ENV BUILD_DATE="${BUILD_DATE}" \
    VERSION="${VERSION}" \
    VCS_REF="${VCS_REF}"

# Create non-root user
RUN groupadd -r "${PACKAGE_NAME_SHORT:-orb}" \
    && useradd -r -g "${PACKAGE_NAME_SHORT:-orb}" -s /bin/false "${PACKAGE_NAME_SHORT:-orb}"

# Set working directory and create directories
WORKDIR /app
RUN mkdir -p /app/logs /app/data /app/tmp

# Install UV and create virtual environment in single layer
RUN pip install --no-cache-dir uv==0.8.12 \
    && uv venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Copy pre-built wheel and install dependencies
COPY dist/*.whl /tmp/
RUN uv pip install --no-cache /tmp/*.whl \
    && rm -rf /tmp/*.whl

# Copy only runtime files needed
COPY config/ ./config/
# Provide a default config so the container starts without an external volume mount.
# config/config.json is gitignored (user-specific); fall back to the committed example.
RUN if [ ! -f /app/config/config.json ]; then cp /app/config/config.example.json /app/config/config.json; fi
COPY src/orb/infrastructure/scheduler/hostfactory/scripts/ ./scripts/
COPY deployment/docker/docker-entrypoint.sh ./docker-entrypoint.sh

# Set permissions and environment in single layer
RUN chmod +x ./docker-entrypoint.sh \
    && chown -R "${PACKAGE_NAME_SHORT:-orb}":"${PACKAGE_NAME_SHORT:-orb}" /app

# Set all environment variables in single layer
ENV PYTHONPATH=/app \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONIOENCODING=utf-8 \
    HF_SERVER_ENABLED=true \
    HF_SERVER_HOST=0.0.0.0 \
    HF_SERVER_PORT=8000 \
    HF_SERVER_WORKERS=1 \
    HF_SERVER_LOG_LEVEL=info \
    HF_SERVER_DOCS_ENABLED=true \
    HF_LOGGING_LEVEL=INFO \
    HF_LOGGING_CONSOLE_ENABLED=true \
    HF_STORAGE_STRATEGY=json \
    HF_STORAGE_BASE_PATH=/app/data \
    HF_PROVIDER_TYPE=aws \
    HF_PROVIDER_AWS_REGION=us-east-1

# Auth configuration - these are public configuration settings, not secrets
ENV HF_AUTH_ENABLED=false \
    HF_AUTH_STRATEGY=none

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "import requests; requests.get('http://localhost:${HF_SERVER_PORT}/health', timeout=5).raise_for_status()" || exit 1

# Expose port
EXPOSE 8000

# Switch to non-root user
USER "${PACKAGE_NAME_SHORT}"

# Set entrypoint
ENTRYPOINT ["./docker-entrypoint.sh"]
CMD ["serve"]