vh
8a824f85a3
Gate rebuilt off vh/muninn-gate main (bc04c4c) for the muninn-dispatch 0.1.4->0.1.5 bump (concept_schema/concept_schema_source row fields). Gate version unchanged at 0.0.14; note to also tag the image with the source SHA for traceability, and that the pin is authoritative in pyproject.
31 lines
1.4 KiB
Docker
31 lines
1.4 KiB
Docker
# muninn-gate — WG-internal HTTP front door for the Muninn ingestion queue (#377).
|
|
# No Dockerfile in the upstream repo (vh/muninn-gate); this is infra-ops's.
|
|
# muninn-dispatch is pinned in pyproject (currently ==0.1.5, from vh/muninn-gate
|
|
# main; bumped from 0.1.4 for the concept_schema/concept_schema_source fields)
|
|
# and comes from the internal Gitea PyPI index "gitea"; the read token (vh) is
|
|
# passed as a BuildKit secret (never baked into a layer). Also tag the image with
|
|
# the source SHA for traceability, since the gate version (0.0.14) is unchanged.
|
|
#
|
|
# DOCKER_BUILDKIT=1 docker build \
|
|
# --secret id=gitea_pw,src=<vh-token-file> \
|
|
# -t muninn-gate:0.0.14 -t muninn-gate:<src-sha> .
|
|
FROM python:3.11-slim
|
|
|
|
RUN pip install --no-cache-dir uv==0.11.* \
|
|
&& useradd --system --uid 10014 --create-home --home-dir /home/gate gate
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml README.md uv.lock ./
|
|
COPY src ./src
|
|
|
|
# Install the app + deps. muninn-dispatch resolves only from the "gitea" index
|
|
# (pinned via [tool.uv.sources]); everything else from PyPI.
|
|
RUN --mount=type=secret,id=gitea_pw \
|
|
UV_INDEX_GITEA_USERNAME=vh \
|
|
UV_INDEX_GITEA_PASSWORD="$(cat /run/secrets/gitea_pw)" \
|
|
uv pip install --system --no-cache .
|
|
|
|
# The launcher (compose) owns the bind — no CMD here. The app carries `bind`
|
|
# for observability only; --host/--port passed by compose are authoritative.
|
|
USER gate
|