| # fly-trader: the trading engine and its console, on the CPU (a Linux container has no Metal GPU; the fly infers fine on CPU). | |
| # Two images from one file: | |
| # default (last stage, "brain"): the engine, console and vault worker. It holds NO wallet key. | |
| # --target signer: the only holder of the hot keys (fly_trader/signer): standard library + solders + httpx, nothing | |
| # else of fly_trader, so none of the brain's dependencies ever run next to a key. | |
| # Base images are pinned by digest and every Python dependency by hash (uv.lock, docker/signer-requirements.txt): a | |
| # release builds exactly what was reviewed, whatever the registries serve later. | |
| ARG PYTHON_IMAGE=python:3.13-slim@sha256:7c61056e61ac89e852de05f3dc6fa51a6dd2181797bceed46aa725dd7cb2cd3b | |
| # ---------------------------------------------------------------- the signer | |
| FROM ${PYTHON_IMAGE} AS signer | |
| ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=/app | |
| RUN apt-get update && apt-get install -y --no-install-recommends age && rm -rf /var/lib/apt/lists/* \ | |
| && groupadd -g 10000 fly && useradd -u 10002 -g 10000 -M -s /usr/sbin/nologin signer | |
| COPY docker/signer-requirements.txt /tmp/req.txt | |
| RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /tmp/req.txt && rm /tmp/req.txt | |
| WORKDIR /app | |
| COPY fly_trader/__init__.py fly_trader/__init__.py | |
| COPY fly_trader/signer fly_trader/signer | |
| USER 10002:10000 | |
| HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 CMD python -m fly_trader.signer ping || exit 1 | |
| CMD ["python", "-m", "fly_trader.signer", "serve"] | |
| # ---------------------------------------------------------------- the brain (default) | |
| FROM ${PYTHON_IMAGE} AS brain | |
| ENV PYTHONUNBUFFERED=1 \ | |
| UV_PROJECT_ENVIRONMENT=/app/.venv \ | |
| UV_COMPILE_BYTECODE=1 \ | |
| HOME=/tmp \ | |
| PATH="/app/.venv/bin:${PATH}" | |
| # openssh-client: ssh-keygen verifies signed releases (the self-updater, fly_trader/ops/autoupdate.py) | |
| RUN apt-get update && apt-get install -y --no-install-recommends postgresql-client ca-certificates curl age openssh-client \ | |
| && rm -rf /var/lib/apt/lists/* \ | |
| && groupadd -g 10000 fly && useradd -u 10001 -g 10000 -M -s /usr/sbin/nologin fly | |
| COPY --from=ghcr.io/astral-sh/uv:0.12.19@sha256:04d046b13e60d6bcec73cbc5e1cad25d680dea90c8573340950a0ac2d1aef424 /uv /usr/local/bin/uv | |
| WORKDIR /app | |
| COPY . . | |
| # Which torch: TORCH_INDEX=cpu (default: any machine, ~200 MB), cu126 / cu130 for an NVIDIA GPU (the CUDA runtime is | |
| # inside the wheel; the host needs only the driver and the NVIDIA Container Toolkit -- see docker-compose.cuda.yml), or | |
| # rocm72 for an AMD GPU (the ROCm runtime is inside the wheel; the host needs only the amdgpu driver -- | |
| # docker-compose.rocm.yml). | |
| # It names the project extra that pins torch to that index. --frozen: exactly uv.lock with its hashes, never a fresh | |
| # resolution. The project installs editable: the package IS /app/fly_trader, so config.REPO_ROOT is /app. | |
| ARG TORCH_INDEX=cpu | |
| ENV TORCH_INDEX=${TORCH_INDEX} | |
| RUN uv sync --frozen --no-dev --extra "${TORCH_INDEX}" \ | |
| && chmod +x /app/docker/entrypoint.sh \ | |
| && mkdir -p /app/fly_trader/ui/static/brain && chown -R 10001:10000 /app/fly_trader/ui/static/brain | |
| # The vault server runs this unprivileged user and never updates itself (AUTO_UPDATE=0). The self-hosted compose file | |
| # runs the container as root instead: its self-updater replaces /app, and it writes the bind-mounted data/, logs/, .env. | |
| USER 10001:10000 | |
| EXPOSE 8501 | |
| # healthy = the database answers, the console's worker threads run and (on the vault server) the signer answers | |
| HEALTHCHECK --interval=30s --timeout=20s --start-period=300s --retries=5 CMD fly-trader health || exit 1 | |
| ENTRYPOINT ["/app/docker/entrypoint.sh"] | |