Dockerfile.safe-watcher

FROM python:3.13-slim

# SECURITY: CVE-2025-58050 mitigation - PCRE2 heap buffer overflow
# SECURITY: CVE-2025-7709 mitigation - SQLite3 vulnerability
# TODO: Remove explicit upgrades when base image includes patched versions
RUN apt-get update && \
    (apt-get install -y --only-upgrade libpcre2-8-0 2>/dev/null || \
     echo "Warning: PCRE2 10.46+ not yet available") && \
    (apt-get install -y --only-upgrade libsqlite3-0 sqlite3 2>/dev/null || \
     echo "Warning: SQLite3 patch not yet available") && \
    apt-get upgrade -y && rm -rf /var/lib/apt/lists/*

# Install system dependencies
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
    gcc \
    g++ \
    procps \
    && rm -rf /var/lib/apt/lists/*

# Upgrade pip and install setuptools
RUN pip install --upgrade pip setuptools wheel

# Install Python dependencies (matching importer)
RUN pip install --no-cache-dir \
    qdrant-client==1.15.0 \
    fastembed==0.7.1 \
    numpy>=2.1.0 \
    psutil==7.0.0 \
    python-dotenv==1.0.0 \
    voyageai==0.3.4 \
    tenacity==9.1.2 \
    humanize==4.12.3 \
    tqdm==4.67.1

# Pre-download and cache the FastEmbed model
ENV FASTEMBED_CACHE_PATH=/root/.cache/fastembed
RUN mkdir -p /root/.cache/fastembed && \
    python -c "from fastembed import TextEmbedding; TextEmbedding(model_name='sentence-transformers/all-MiniLM-L6-v2')"

# Set working directory
WORKDIR /app

# Copy source code
COPY src/ /app/src/
COPY shared/ /app/shared/

# Set PYTHONPATH for proper imports
ENV PYTHONPATH=/app

# Make scripts executable
RUN chmod +x /app/src/runtime/*.sh /app/src/runtime/*.py

# Create config directory
RUN mkdir -p /config

# Set environment variables for memory management
ENV PYTHONUNBUFFERED=1
ENV MALLOC_ARENA_MAX=2

# Run the watcher loop
CMD ["/app/src/runtime/watcher-loop.sh"]