Commit History
-
fix(docker): repair builder/runtime Python mismatch in dockerfile-samgis-base
alessandro trinca tornidorUnverified signaturebuilder_global was FROM dhi.io/python:3.13-dev (Python installed at /usr), while runtime was pinned to dhi.io/python:3.13 hardened (Python installed at /opt/python). Copying the builder's venv into runtime left a broken `.venv/bin/python3` symlink pointing at a path that doesn't exist there, which silently fell through to the runtime's own bare interpreter with none of the installed packages — surfaced as "ModuleNotFoundError: No module named 'rasterio'" in the runtime smoke test on the 1.12.17 build. Pin builder_global to the exact same digest as runtime, eliminating the path mismatch. Since that image has no shell, convert its 3 shell-form RUN instructions (mkdir, venv+pip via &&, model download) to exec-form, using paths relative to WORKDIR rather than ${WORKDIR_ROOT} substitution (not guaranteed inside exec-form JSON arrays without a shell). builder_global also now runs as the hardened image's default `nonroot` user (uid 65532) instead of root, so download_models.py's `~/.samgis/…4ef9a55
-
fix(deps): bump samgis-web==1.3.8 (starlette PYSEC-2026-161, idna GHSA-65pc-fj4g-8rjx), version 1.12.12
alessandro trinca tornidorUnverified signature- bump samgis-web==1.3.8, samgis-core==4.1.12, sam2-onnx==0.3.10 - starlette 0.52.1 → 1.1.0 (PYSEC-2026-161 BadHost path-auth bypass) - idna 3.11 → 3.16 (GHSA-65pc-fj4g-8rjx CVE-2024-3651 bypass) - fastapi 0.129.2 → 0.136.1 (required to unblock starlette 1.x) - pin dhi.io/python:3.13@sha256:a87c4bc7... in dockerfile-samgis-base - update Dockerfile base to gis-prediction:1.12.12 - update docs/CHANGELOG.mdf202f19
-
fix(deps,security): bump samgis 1.12.9→1.12.11, update full dep stack
alessandro trinca tornidorUnverified signaturepyproject.toml: version 1.12.9→1.12.11, samgis-web==1.3.5→==1.3.7. Dockerfile: base image tag 1.12.9→1.12.11. uv.lock + requirements.txt: samgis-web 1.3.5→1.3.7, samgis-core 4.1.8→4.1.11, sam2-onnx 0.3.7→0.3.9, pyright 1.1.408→1.1.409, drop bson. app.py: explanatory comment for 0.0.0.0 binding (bandit B104). client_health.py: explanatory comment for localhost urlopen (bandit B310).bf28c58
-
feat: migrate from Poetry to uv as package manager
alessandro trinca tornidorConvert pyproject.toml to PEP 621 + PEP 735 dependency-groups. Docker builder no longer installs Poetry — uses pip install --require-hashes from uv-exported requirements.txt. Dockerfile smoke tests converted to exec-form RUN for distroless compatibility.d53e2be -
fix: harden supply chain and patch CVE-2026-33228
alessandro trinca tornidor- Add --require-hashes to pip install in Dockerfile with SHA-256 hashes for pip and poetry (supply chain integrity) - Override flatted to >=3.4.2 via pnpm.overrides (CVE-2026-33228, transitive via @vitest/ui) - Move npm-style top-level overrides into pnpm.overrides where pnpm actually reads them (minimatch, rollup, ajv were previously ignored) - Replace detail=str(e) with generic message in health_check HTTPException to prevent internal path leakage - Add .post-production-stamp to .gitignoref3084a8
-
feat(frontend): display SAM2 model variant in map description
alessandro trinca tornidorVITE__MODEL_VARIANT is injected at Docker build time from MODEL_VARIANT. Description shows "ML predictions powered by <variant>". VITE__MAP_DESCRIPTION prepends to (not replaces) the model description.cf1ae5d -
chore(frontend): remove dead env vars and add .env.example
alessandro trinca tornidorOnly VITE__MAP_DESCRIPTION and VITE_INDEX_URL are used in source. Remove unused VITE__SAMGIS_SPACE Docker build-arg. Remove debug console.log from App.vue. Add .env.example with documented vars.863160d -
refactor: migrate model resolution from sam-quantized submodule to SAM2 HF registry
alessandro trinca tornidorReplace hardcoded sam-quantized submodule path with resolve_model_folder() that supports MODEL_FOLDER env override and falls back to the samgis_core model registry (~/.samgis/models/<variant>/). - Fix broken samgis_core.utilities.constants import in /health endpoint - /health now uses verify_download() for SHA-256 integrity checking - Add scripts/download_models.py CLI for model download with hash verification - Update Dockerfiles: builder downloads models, runtime gets MODEL_FOLDER env - Default variant: sam2.1_hiera_base_plus_uint8 - Update CLAUDE.md to reflect new model setup7f59cb9 -
build: migrate Docker images to Docker Hardened Images (DHI)
alessandro trinca tornidor- Builder: dhi.io/python:3.13-dev (has apt, pip, shell) - Runtime: dhi.io/python:3.13 (no shell, no pkg manager, nonroot user) - Remove libGL (not needed: PIL manylinux bundles its own) - Remove system GDAL (not needed: rasterio manylinux wheels bundle it) - Keep libexpat (needed by rasterio's bundled GDAL at runtime) - Use nonroot user (65532) instead of custom python (999) - HEALTHCHECK exec form (no shell in runtime) - Clean up debug RUN layers in Dockerfile (57→23 lines) - Add .cursor to .dockerignore - Update CLAUDE.md Docker structure docs Base image: 203MB 25CVEs → 22MB 3CVEs (2L + 1 unspecified)f17138a
-
ci: revert to dockerfiles based on python debian/trixie image, remove, rollback to onnxruntime as direct dependency
alessandro trinca tornidor47cb783 -
ci: remove old dockerfiles for AWS, add dockerfile based on alpinelinux
alessandro trinca tornidorbe6b0b0
-
ci: rename health.py to client_health.py, update dockerfiles
alessandro trinca tornidord83263c -
ci: refactor dockerfiles moving to alpine linux
alessandro trinca tornidorf0ae2d5
-
ci: change python:3.12 image from bookworm to trixie, remove zlib1g package installation
alessandro trinca tornidor64ae857
-
refactor: remove machine_learning_models unix symlink and reference directly the submodule sam-quantized
alessandro trinca tornidor463d79e -
refactor: sam-quantized submodule now referrenced without symlinks, update dockerfile
alessandro trinca tornidor606a7d7
-
ci: workaround for missing /home folder within the docker image, bump to version 1.11.7
alessandro trinca tornidor233631f -
ci: fix the tailwindcss build command within the docker image, bump to 1.11.6 version
alessandro trinca tornidor45f1577
-
ci: update docker images to use node:22-slim, docker image version to 1.11.0
6507a0a
-
ci: improve docker images security, bump to version 1.10.0
cef51c1
-
feat: install libexpat1 debian package to avoid error on rasterio python import
e8f851a
-
doc: update CHANGELOG.md, README.md, frontend and backend dependencies
0139375
-
ci: update Dockerfile because of removed fastapi poetry dependency group
7eaf013
-
feat: move back Dockerfile to rot project
426c7b6
-
ci: update Dockerfile, requirements.txt
4759981 -
chore: update docker image to version 1.6.4, bump to version 1.6.4
6032019 -
chore: update docker image to version 1.6.3, bump to version 1.6.3
4fae1c6 -
chore: bump to version 1.6.1
c4fea3d -
ci: improve docker build process aadding --no-cache to poetry install steps (cache is on docker image level anyway)
704713d
-
feat: first working local docker container depending on samgis_core and samgis_web
e0b709e
-
[feat] copy list_files.html into static/ folder; update dockerfile version
3f763b7
-
[ci] use python docker image 3.11, bump to version 1.4.1
a5a70f7
-
[ci] use python 3.10 as base docker image
126f5b8
-
[refactor] import aws_lambda_powertools and define tests about aws lambda integration only when IS_AWS_LAMBDA is defined
8bc95c0
-
[ci] fix zlib1g security vulnerability
f8218e8
-
[feat] move direct url space link to footer, remove close button
75c1512
-
[feat] show link about embedded huggingspace on small devices
fea8a6e
-
[ci] try to better support huggingface CI
7af7458
-
[feat] add working static frontend
9954ac1 -
[refactor] first working stage for huggingface docker container with fastapi and loguru
7c6fa68
-
[refactor] use poetry also to build the aws docker images
d95b5e7
-
[refactor] renamed backend package to samgis
2979556 -
[refactor] start decoupling backend code from aws wrapper
2ff94a6
-
[refactor] remove unused Dockerfile, try installing sphinx with requirements.txt in cloudflare pages ci
869eadc
-
[docs] add more docs content
6f2f547
-
[ci] switch base docker image to python:3.11-slim-bookworm, use opencv-python-headless
c6215d1 -
[ci] use requirements.txt in dockerfile-lambda-gdal-runner
a354309
-
[feat] wip workflow from request to response
6d1f220
-
[feat] use post body as input
43d87b3 -
[debug] change architecture to x86
b2b1ed7