Spaces:
Running
Running
| # syntax=docker/dockerfile:1.4 | |
| # Pin official release checksums and extract only the CPU runtime. Importing the | |
| # GPU image duplicates gigabytes under VFS before the runtime COPY can filter it. | |
| FROM debian:bookworm-slim AS ollama-source | |
| ARG TARGETARCH | |
| RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl zstd \ | |
| && rm -rf /var/lib/apt/lists/* | |
| RUN --mount=type=secret,id=proxy_ca \ | |
| set -eu; \ | |
| if [ -f /run/secrets/proxy_ca ]; then export CURL_CA_BUNDLE=/run/secrets/proxy_ca; fi; \ | |
| case "$TARGETARCH" in \ | |
| amd64) ollama_sha=c164ab8b1b28e2a247c29719b8e404c423c5b83ae64c3ab4e59d50c7ff7fc5e0 ;; \ | |
| arm64) ollama_sha=0a279d9428ad17b06fdb7dddf3b059b2c148433585fa3b30676a102fc459bb9f ;; \ | |
| *) echo "Unsupported Ollama CPU architecture: $TARGETARCH" >&2; exit 1 ;; \ | |
| esac; \ | |
| curl --fail --location --retry 3 \ | |
| "https://github.com/ollama/ollama/releases/download/v0.40.6/ollama-linux-${TARGETARCH}.tar.zst" \ | |
| --output /tmp/ollama.tar.zst; \ | |
| echo "$ollama_sha /tmp/ollama.tar.zst" | sha256sum --check --strict; \ | |
| tar --zstd --extract --file /tmp/ollama.tar.zst --directory /usr \ | |
| --wildcards --no-wildcards-match-slash --no-recursion 'bin/ollama' 'lib/ollama/*'; \ | |
| rm /tmp/ollama.tar.zst | |
| FROM debian:bookworm-slim AS ollama-models | |
| RUN apt-get update && apt-get install -y --no-install-recommends \ | |
| ca-certificates curl libstdc++6 libgomp1 \ | |
| && rm -rf /var/lib/apt/lists/* | |
| COPY --from=ollama-source /bin/ollama /bin/ollama | |
| COPY --from=ollama-source /usr/lib/ollama/*.so* /usr/lib/ollama/ | |
| COPY --from=ollama-source /usr/lib/ollama/llama-server /usr/lib/ollama/llama-server | |
| COPY --from=ollama-source /usr/lib/ollama/*LICENSE* /usr/lib/ollama/ | |
| ARG OLLAMA_EMBEDDING_MODEL=embeddinggemma-2:270m | |
| ARG OLLAMA_CHAT_MODEL= | |
| ENV OLLAMA_MODELS=/opt/ollama-models OLLAMA_NUM_PARALLEL=1 OLLAMA_MAX_LOADED_MODELS=1 OLLAMA_NO_CLOUD=true | |
| COPY scripts/preload_ollama_models.sh /tmp/preload_ollama_models.sh | |
| RUN --mount=type=secret,id=proxy_ca \ | |
| if [ -f /run/secrets/proxy_ca ]; then export SSL_CERT_FILE=/run/secrets/proxy_ca; fi; \ | |
| OLLAMA_EMBEDDING_MODEL="$OLLAMA_EMBEDDING_MODEL" OLLAMA_CHAT_MODEL="$OLLAMA_CHAT_MODEL" \ | |
| bash /tmp/preload_ollama_models.sh | |
| # Assemble CPU/model files once, avoiding repeated large runtime snapshots on VFS. | |
| FROM scratch AS ollama-runtime | |
| COPY --from=ollama-models /bin/ollama /usr/bin/ollama | |
| COPY --from=ollama-models /usr/lib/ollama /usr/lib/ollama | |
| COPY --from=ollama-models /opt/ollama-models /opt/ollama-models | |
| # ── Stage 1: Console builder ──────────────────────────────── | |
| FROM node:22.22.0-bookworm-slim AS console-builder | |
| WORKDIR /console | |
| COPY console/package.json console/package-lock.json ./ | |
| RUN --mount=type=secret,id=proxy_ca \ | |
| if [ -f /run/secrets/proxy_ca ]; then export NODE_EXTRA_CA_CERTS=/run/secrets/proxy_ca; fi; \ | |
| npm ci | |
| COPY console/ ./ | |
| RUN chmod +x node_modules/.bin/* 2>/dev/null || true | |
| RUN npm run build | |
| # ── Stage 2: Python builder ───────────────────────────────── | |
| FROM python:3.11.14-slim-bookworm AS builder | |
| WORKDIR /app | |
| ARG INSTALL_LOCAL_ML=false | |
| ENV PYTHONUNBUFFERED=1 \ | |
| PYTHONDONTWRITEBYTECODE=1 \ | |
| PIP_NO_CACHE_DIR=1 \ | |
| PIP_RETRIES=8 \ | |
| PIP_TIMEOUT=900 \ | |
| PIP_DEFAULT_TIMEOUT=900 \ | |
| POETRY_NO_INTERACTION=1 \ | |
| POETRY_VIRTUALENVS_IN_PROJECT=true \ | |
| HF_HOME=/app/.cache \ | |
| SENTENCE_TRANSFORMERS_HOME=/app/.cache \ | |
| TIKTOKEN_CACHE_DIR=/app/.cache/tiktoken | |
| RUN --mount=type=secret,id=proxy_ca \ | |
| set -eu; \ | |
| if [ -f /run/secrets/proxy_ca ]; then \ | |
| export PIP_CERT=/run/secrets/proxy_ca GIT_SSL_CAINFO=/run/secrets/proxy_ca; \ | |
| fi; \ | |
| apt-get update && apt-get install -y --no-install-recommends \ | |
| build-essential git postgresql-15 postgresql-server-dev-15 \ | |
| && rm -rf /var/lib/apt/lists/* \ | |
| && pip install --no-cache-dir poetry==2.1.3 \ | |
| && git clone --branch v0.5.1 https://github.com/pgvector/pgvector.git /tmp/pgvector \ | |
| && cd /tmp/pgvector && make && make install \ | |
| && rm -rf /tmp/pgvector /root/.cache | |
| COPY --chmod=644 pyproject.toml poetry.lock ./ | |
| RUN --mount=type=secret,id=proxy_ca \ | |
| if [ -f /run/secrets/proxy_ca ]; then \ | |
| export SSL_CERT_FILE=/run/secrets/proxy_ca PIP_CERT=/run/secrets/proxy_ca REQUESTS_CA_BUNDLE=/run/secrets/proxy_ca; \ | |
| fi; \ | |
| if [ "$INSTALL_LOCAL_ML" = "true" ]; then \ | |
| poetry sync --no-root --only main --with local-ml; \ | |
| else \ | |
| poetry sync --no-root --only main; \ | |
| fi \ | |
| && mkdir -p "$TIKTOKEN_CACHE_DIR" \ | |
| && /app/.venv/bin/python -c "import tiktoken; tiktoken.get_encoding('cl100k_base')" \ | |
| && rm -rf /root/.cache /tmp/* | |
| COPY --chmod=755 src/ ./src/ | |
| COPY scripts/preload_docker_models.py ./scripts/ | |
| RUN if [ "$INSTALL_LOCAL_ML" = "true" ]; then \ | |
| /app/.venv/bin/python scripts/preload_docker_models.py; \ | |
| fi \ | |
| && rm -rf /root/.cache /tmp/* | |
| # Validate small runtime inputs before combining them with large dependencies. | |
| FROM debian:bookworm-slim AS runtime-config | |
| WORKDIR /runtime/app | |
| COPY --chmod=755 deploy/ ./deploy/ | |
| COPY entrypoint.sh ./ | |
| COPY --chmod=644 CONNECTION.md ./ | |
| COPY --chmod=755 scripts/ ./scripts/ | |
| RUN test -f scripts/start_with_ollama.py \ | |
| && test -f scripts/preload_ollama_models.sh \ | |
| && chmod +x entrypoint.sh | |
| # Assemble files on an empty root, avoiding a full PostgreSQL/Python root copy | |
| # for every small COPY when the cloud Docker daemon uses VFS snapshots. | |
| FROM scratch AS runtime-files | |
| COPY --from=builder /usr/lib/postgresql/15/lib/vector.so /usr/lib/postgresql/15/lib/ | |
| COPY --from=builder /usr/share/postgresql/15/extension/vector* /usr/share/postgresql/15/extension/ | |
| COPY --from=runtime-config /runtime/ / | |
| COPY --from=console-builder /console/dist /app/console/dist | |
| COPY --from=builder /app /app | |
| COPY --from=ollama-runtime / / | |
| # ── Stage 3: runtime ──────────────────────────────────────── | |
| FROM python:3.11.14-slim-bookworm | |
| WORKDIR /app | |
| ENV PYTHONUNBUFFERED=1 \ | |
| PYTHONDONTWRITEBYTECODE=1 \ | |
| PATH="/app/.venv/bin:$PATH" \ | |
| HF_HOME=/app/.cache \ | |
| SENTENCE_TRANSFORMERS_HOME=/app/.cache \ | |
| TIKTOKEN_CACHE_DIR=/app/.cache/tiktoken \ | |
| PIP_NO_CACHE_DIR=1 \ | |
| PIP_RETRIES=8 \ | |
| PIP_TIMEOUT=900 \ | |
| PIP_DEFAULT_TIMEOUT=900 | |
| RUN apt-get update && apt-get upgrade -y \ | |
| && apt-get install -y --no-install-recommends \ | |
| curl \ | |
| git \ | |
| util-linux \ | |
| postgresql-15 \ | |
| postgresql-contrib-15 \ | |
| redis-server \ | |
| nginx \ | |
| supervisor \ | |
| libgomp1 \ | |
| && rm -rf /var/lib/apt/lists/* \ | |
| && python -m pip uninstall -y setuptools wheel \ | |
| && groupadd -r appuser && useradd -r -g appuser -m appuser \ | |
| && mkdir -p /app/plugins && chown appuser:appuser /app/plugins | |
| COPY --from=runtime-files / / | |
| # Revision labels must not invalidate the dependency-installation layer. | |
| ARG BUILD_DATE | |
| ARG BUILD_SHA | |
| ENV BUILD_SHA=${BUILD_SHA} | |
| LABEL build_date="${BUILD_DATE}" \ | |
| build_sha="${BUILD_SHA}" | |
| VOLUME ["/app/plugins"] | |
| EXPOSE 7860 | |
| HEALTHCHECK --interval=30s --timeout=30s --start-period=120s --retries=5 \ | |
| CMD curl -f http://127.0.0.1:7860/health || exit 1 | |
| USER root | |
| ENTRYPOINT ["/app/entrypoint.sh"] | |