File size: 2,810 Bytes
ca4d83b | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 | # Hugging Face Space scaffold for aureon-public. This image is not deployed
# and this file does not create a Hugging Face repository.
#
# Build from this directory:
# docker build -f Dockerfile -t aureon-public .
#
# The runtime install matches measured/aureon_public_stage1_run.sh:
# requirements.txt (mcp==1.30.0,<2 and the aureon pin), then the mcp package
# with --no-deps. test-requirements.txt is not installed.
#
# No API key is baked in. AUREON_PUBLIC_API_KEY is a runtime secret. The image
# sets AUREON_PUBLIC_OPEN=1 so the read-only surface can bind on the Space port
# when that secret is absent. AUREON_PUBLIC_SWEEP is not set.
FROM python:3.12-slim-bookworm
RUN apt-get update \
&& apt-get install -y --no-install-recommends git ca-certificates \
&& rm -rf /var/lib/apt/lists/*
# Full history of main so git rev-parse of the aureon pin still resolves.
# A shallow clone would omit that commit.
# AUREON_REF defaults to the merge commit of #225. That tree contains the
# aureon pin. Do not set cf43882e as a standing default.
ARG AUREON_REPO=https://github.com/RA-CONSULTING/Aureon-OS.git
ARG AUREON_REF=0390194b80cddb66c8cfd052efe3aa4f9d1545d6
# The first Hugging Face build log must show the AUREON_REF build arg.
RUN test -n "$AUREON_REF" \
&& echo "AUREON_REF=${AUREON_REF}" \
&& git clone --branch main --single-branch "$AUREON_REPO" /opt/aureon-os \
&& git -C /opt/aureon-os checkout "$AUREON_REF" \
&& git config --system --add safe.directory /opt/aureon-os
# Overlay this directory so the image runs the scaffold beside the Dockerfile,
# including files that are not on AUREON_REF yet. The overlay is the public
# package only. It does not replace aureon/ and it does not add a key.
COPY . /opt/aureon-os/mcp/aureon_public/
WORKDIR /opt/aureon-os
RUN python -m pip install --no-cache-dir -U pip \
&& python -m pip install --no-cache-dir -r mcp/aureon_public/requirements.txt \
&& python -m pip install --no-cache-dir -e mcp --no-deps \
&& rm -rf /root/.cache/pip
RUN useradd --create-home --uid 1000 aureon \
&& mkdir -p /tmp/aureon-public-space \
&& chown -R aureon:aureon /tmp/aureon-public-space
USER aureon
WORKDIR /tmp/aureon-public-space
# Listen on 0.0.0.0. The MCP SDK turns DNS-rebinding protection on when the
# process binds 127.0.0.1, and then answers 421 to Host: *.hf.space.
# Open mode and keyed mode on the Space stay on 0.0.0.0. A process with
# neither AUREON_PUBLIC_OPEN=1 nor AUREON_PUBLIC_API_KEY still refuses that bind.
ENV AUREON_PUBLIC_REQUIRE_PIN=1 \
AUREON_OBSERVER_MODE=dry_run \
AUREON_PUBLIC_OPEN=1 \
AUREON_PUBLIC_HOST=0.0.0.0 \
AUREON_PUBLIC_MAX_INFLIGHT=4 \
PORT=7860 \
PYTHONDONTWRITEBYTECODE=1 \
PYTHONUNBUFFERED=1
EXPOSE 7860
CMD ["python", "-m", "aureon_public.space"]
|