feat(docker): production-optimized multi-stage Dockerfile

.dockerignore

@@ -1,15 +1,57 @@
+# VCS
 .git
+.github
+.gitignore
+
+# Python artifacts
 __pycache__
 *.pyc
 *.pyo
+*.egg-info
+dist/
+build/
+
+# Dev/test tooling
 .pytest_cache
 .coverage
 .mypy_cache
 .ruff_cache
+.pre-commit-config.yaml
+.venv
+venv
+
+# Tests & docs (not needed in image)
 tests/
 docs/
+mkdocs.yml
 CHANGELOG.md
 LICENSE
 NOTICE
+
+# JS/TS artifacts (dashboard, SDK — not part of proxy image)
+apps/
+sdk/
+plugins/
+node_modules/
+*.tgz
+
+# Secrets & local config
 .env
-*.log
+.env.*
+*.log
+
+# IDE
+.vscode
+.idea
+*.swp
+
+# Docker
+Dockerfile
+docker-compose*.yml
+.dockerignore
+
+# Misc
+.pi-lens/
+.superpowers/
+examples/
+node-compile-cache/

.github/workflows/docker.yml

@@ -0,0 +1,67 @@
+name: Docker
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+  id-token: write
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=sha-
+
+      - name: Build and push
+        id: push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

Dockerfile

@@ -1,8 +1,52 @@
-FROM python:3.11-slim
-RUN apt-get update && apt-get install -y --no-install-recommends curl build-essential g++ && rm -rf /var/lib/apt/lists/*
-COPY . /app
-WORKDIR /app
-RUN pip install -e .[proxy]
+# ---- Build stage: compile native extensions, build wheel ----
+FROM python:3.11-slim AS builder
+
+RUN apt-get update && \
+  apt-get install -y --no-install-recommends \
+    build-essential \
+    g++ \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+WORKDIR /build
+
+# Layer 1: install deps only (cached unless pyproject.toml/uv.lock change)
+COPY pyproject.toml uv.lock README.md ./
+# Stub package so uv can resolve the local ".[proxy]" without full source
+RUN mkdir -p headroom && touch headroom/__init__.py
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install --system ".[proxy]"
+
+# Layer 2: copy real source, reinstall only headroom-ai (no deps)
+COPY headroom/ headroom/
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv pip install --system --no-deps --reinstall-package headroom-ai .
+
+# ---- Runtime stage: minimal image with only what's needed ----
+FROM python:3.11-slim AS runtime
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends curl && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --gid 1000 headroom && \
+    useradd --uid 1000 --gid headroom --create-home headroom
+
+COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
+COPY --from=builder /usr/local/bin/headroom /usr/local/bin/headroom
+
+RUN mkdir -p /data /home/headroom/.headroom && \
+    chown -R headroom:headroom /data /home/headroom/.headroom
+
+USER headroom
+WORKDIR /home/headroom
+
+ENV HEADROOM_HOST=0.0.0.0 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
+
 EXPOSE 8787
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 CMD curl -f http://localhost:8787/health || exit 1
-ENTRYPOINT ["headroom", "proxy"]
+
+ENTRYPOINT ["headroom", "proxy"]
+CMD ["--host", "0.0.0.0", "--port", "8787"]