blob: 9e33065d720f1775a2fa27164a2112c383c27ce6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
FROM debian:trixie-slim
ENV DEBIAN_FRONTEND=noninteractive
# ---- System packages ----
RUN apt-get update && apt-get install -y --no-install-recommends \
sudo \
curl \
wget \
git \
ca-certificates \
gnupg \
jq \
ripgrep \
less \
vim \
sqlite3 \
python3 \
python3-pip \
python3-venv \
build-essential \
pkg-config \
procps \
iputils-ping \
&& rm -rf /var/lib/apt/lists/*
# ---- Narrow sudo for senia (apt only, no password) ----
RUN echo "senia ALL=(root) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get" \
> /etc/sudoers.d/senia-apt \
&& chmod 440 /etc/sudoers.d/senia-apt \
&& visudo -c -f /etc/sudoers.d/senia-apt
# ---- Node + claude code ----
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
&& apt-get install -y --no-install-recommends nodejs \
&& rm -rf /var/lib/apt/lists/*
RUN npm install -g npm@11.14.0
RUN npm install -g @anthropic-ai/claude-code
# ---- Non-root user ----
ARG USER_UID=750
ARG USER_GID=750
RUN groupadd --system --gid ${USER_GID} senia \
&& useradd --system --uid ${USER_UID} --gid ${USER_GID} -m -s /bin/bash senia \
&& echo "umask 002" >> /home/senia/.bashrc
# ---- uv (the python project manager for the agent loop) ----
# Single static binary, no python deps. The official image is the canonical install path.
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
# uv config:
# - put venvs in a known location, not next to pyproject.toml
# - compile bytecode at install time for faster startup
# - copy instead of hardlink for predictable docker layer behavior
ENV UV_PROJECT_ENVIRONMENT=/opt/venv \
UV_COMPILE_BYTECODE=1 \
UV_LINK_MODE=copy
# ---- User-level tools for senia (claude code, npm prefix) ----
USER senia
# Set up npm prefix for any *other* user-level node tools senia might want
RUN mkdir -p /home/senia/.npm-global \
&& npm config set prefix /home/senia/.npm-global
USER root
# senia's PATH includes her user-local npm bins + the venv that uv populates
ENV PATH="/opt/venv/bin:/home/senia/.npm-global/bin:$PATH"
# ---- Agent project install (with layer caching) ----
# Deps first; cached as long as pyproject.toml + uv.lock are unchanged
COPY --chown=senia:senia agent/pyproject.toml agent/uv.lock /etc/senia/agent/
WORKDIR /etc/senia/agent
RUN uv sync --frozen --no-install-project --no-dev
# Then the project code
COPY --chown=senia:senia agent/ /etc/senia/agent/
RUN uv sync --frozen --no-dev
# ---- Runtime ----
USER senia
# WORKDIR /etc/senia/agent
EXPOSE 8000
CMD ["uvicorn", "orchestrator.api:app", "--host", "0.0.0.0"]
|
