Dockerfile

# ============================================================
# Dify 1.17.0 All-in-One for Hugging Face Spaces
#
# FIX 2:
# - Keep Dify Web 1.17 runtime at its ORIGINAL absolute paths:
#       /app/targets
#       /app/entrypoint.sh
#   because the official web entrypoint calls
#       /app/targets/next/web/server.js
# - Add ca-certificates for verified Upstash Redis TLS.
# - Keep API/Web/Worker/Plugin/Nginx in one HF container.
# ============================================================

FROM langgenius/dify-web:1.17.0 AS web
FROM langgenius/dify-plugin-daemon:0.6.10-local AS plugin_daemon
FROM langgenius/dify-api:1.17.0

USER root

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        nginx \
        redis-server \
        redis-tools \
        ca-certificates \
        locales \
        curl \
        ffmpeg \
        git \
        build-essential \
        cmake \
        pkg-config \
        libcairo2-dev \
        libjpeg62-turbo-dev \
        libgif-dev \
    && update-ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && localedef \
        -i en_US \
        -c \
        -f UTF-8 \
        -A /usr/share/locale/locale.alias \
        en_US.UTF-8 || true

ENV LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    PYTHONIOENCODING=utf-8 \
    MALLOC_ARENA_MAX=2 \
    NODE_OPTIONS=--max-old-space-size=2048

# ------------------------------------------------------------
# Dify Web 1.17 official runtime layout.
#
# IMPORTANT:
# Do not relocate these into /app/web.
# /app/entrypoint.sh contains absolute /app/targets/... paths.
# ------------------------------------------------------------
COPY --from=web /app/targets /app/targets
COPY --from=web /app/entrypoint.sh /app/entrypoint.sh

# Plugin daemon binary.
COPY --from=plugin_daemon /app/main /opt/dify-plugin-daemon/main
COPY --from=plugin_daemon /app/commandline /opt/dify-plugin-daemon/commandline

COPY nginx.conf /etc/nginx/nginx.conf
COPY start.sh /app/start.sh
COPY hf_state_keeper.py /app/hf_state_keeper.py

ARG FORCE_REBUILD=20260908_DIFY_1170_HF_FIX3_PLUGIN_MIGRATE_CORS
RUN echo "${FORCE_REBUILD}" > /tmp/dify-build-version

# Writable uv cache for local plugins.
RUN install -d -o dify -g dify -m 0755 /home/dify \
    && install -d -o dify -g dify -m 0755 /home/dify/.cache \
    && install -d -o dify -g dify -m 0755 /home/dify/.cache/uv

# Runtime storage.
RUN mkdir -p \
        /app/api/storage \
        /app/api/storage/privkeys \
        /app/storage \
        /app/storage/cwd \
        /app/storage/plugin \
        /app/storage/plugin_packages \
        /app/storage/assets \
        /app/.tiktoken \
        /var/log/nginx \
        /var/lib/nginx \
        /var/lib/nginx/body \
        /var/lib/nginx/proxy \
        /var/lib/nginx/fastcgi \
        /var/lib/nginx/uwsgi \
        /var/lib/nginx/scgi \
        /var/cache/nginx \
        /run

RUN chmod +x \
        /app/start.sh \
        /app/hf_state_keeper.py \
        /app/entrypoint.sh \
        /opt/dify-plugin-daemon/main \
        /opt/dify-plugin-daemon/commandline \
    && chown -R dify:dify \
        /home/dify \
        /app/api/storage \
        /app/storage \
        /app/targets \
        /app/entrypoint.sh \
        /opt/dify-plugin-daemon \
        /var/log/nginx \
        /var/lib/nginx \
        /var/cache/nginx \
        /run \
        /etc/nginx

# Fail the Docker build immediately if the 1.17 web runtime was copied wrong.
RUN test -f /app/entrypoint.sh \
    && test -f /app/targets/next/web/server.js \
    && test -x /opt/dify-plugin-daemon/commandline \
    && test -f /etc/ssl/certs/ca-certificates.crt \
    && su -s /bin/bash dify -c '\
        test -w /home/dify/.cache/uv && \
        touch /home/dify/.cache/uv/.write-test && \
        rm -f /home/dify/.cache/uv/.write-test && \
        /usr/local/bin/uv --version && \
        node --version && \
        echo "DIFY 1.17 HF FIX2 BUILD TEST = OK" \
    '

ENV PORT=7860 \
    MODE=api \
    DEBUG=false \
    DEPLOY_ENV=PRODUCTION \
    EDITION=SELF_HOSTED

EXPOSE 7860

USER dify
WORKDIR /app/api

ENTRYPOINT []
CMD ["/bin/bash", "/app/start.sh"]