Dockerfile

# DecisionLab: LightDec vs Laya, side by side, on port 9910
FROM python:3.11-slim

# CPU build by default. For an NVIDIA GPU build:
#   docker build --build-arg TORCH_INDEX_URL=https://download.pytorch.org/whl/cu128 -t decisionlab:gpu .
ARG TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
# torch version for both builds; the index adds the +cpu / +cu128 build tag.
ARG TORCH_VERSION=2.14.0

ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    USE_TF=0 \
    TOKENIZERS_PARALLELISM=false \
    HF_HOME=/data/hf \
    PORT=9910

RUN apt-get update \
 && apt-get install -y --no-install-recommends curl ca-certificates \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /srv
COPY requirements-container.txt constraints.txt ./
# Reproducible install:
# 1. torch at a pinned version from the chosen index;
# 2. the app's dependencies, constrained to the exact versions in constraints.txt, torch held in place;
# 3. every constrained package forced to its exact version (covers torch's own dependencies too);
# 4. pip check: an inconsistent set fails the build, not the running app.
RUN pip install "torch==${TORCH_VERSION}" --index-url "${TORCH_INDEX_URL}" \
 && pip freeze | grep -i '^torch==' > /tmp/torch-constraint.txt \
 && pip install -r requirements-container.txt -c constraints.txt -c /tmp/torch-constraint.txt \
 && pip install --no-deps -r constraints.txt \
 && pip check

COPY app ./app
COPY tests ./tests

RUN useradd --create-home --uid 1000 lab && mkdir -p /data/hf && chown -R lab:lab /data /srv
USER lab
VOLUME ["/data/hf"]
EXPOSE 9910

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
  CMD curl -fs http://localhost:9910/api/health || exit 1

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "9910", "--workers", "1"]