Dockerfile
sha256:0032d6cfa33bc3c8367436ad768e7dd0e339b4332153160247da8266cb5fa352
Merge branch 'task/version-tags-phase3-server' into dev
Human
17 days ago
| 1 | # MuseHub — Production Dockerfile |
| 2 | # Build context: ~/ecosystem (parent of musehub/ and muse/). |
| 3 | # Multi-stage build: builder installs deps into wheels; runtime copies only the wheels. |
| 4 | # |
| 5 | # Layer invalidation guide (when to rebuild): |
| 6 | # requirements.txt changed → docker compose build musehub |
| 7 | # muse/ source changed → rebuild (muse is bundled as a wheel) |
| 8 | # Python code changed → no rebuild (override.yml bind-mounts musehub/ tests/ etc.) |
| 9 | |
| 10 | FROM python:3.14-slim AS builder |
| 11 | |
| 12 | WORKDIR /app |
| 13 | |
| 14 | RUN apt-get update && apt-get install -y --no-install-recommends \ |
| 15 | build-essential \ |
| 16 | cargo \ |
| 17 | libssl-dev \ |
| 18 | pkg-config \ |
| 19 | && rm -rf /var/lib/apt/lists/* |
| 20 | |
| 21 | # Build the muse package wheel from source (it lives alongside musehub in the ecosystem). |
| 22 | COPY muse/ /tmp/muse/ |
| 23 | RUN pip wheel --no-cache-dir --no-deps --wheel-dir /app/wheels /tmp/muse |
| 24 | |
| 25 | COPY musehub/requirements.txt . |
| 26 | |
| 27 | # Build cryptography from source with a generic aarch64 CPU target so the Rust |
| 28 | # backend avoids optional instructions (sha512, sm3, etc.) that Docker Desktop's |
| 29 | # ARM VM doesn't expose. --no-binary forces a source build; the flag has no effect |
| 30 | # on x86_64 where the pre-built wheel works fine. |
| 31 | RUN RUSTFLAGS="-C target-cpu=generic" \ |
| 32 | pip wheel --no-cache-dir --no-deps --no-binary cryptography \ |
| 33 | --wheel-dir /app/wheels cryptography==48.0.0 |
| 34 | |
| 35 | # Build all remaining dependencies from pre-built wheels where available. |
| 36 | # Exclude cryptography — already built from source above. |
| 37 | RUN grep -v '^cryptography' requirements.txt \ |
| 38 | | pip wheel --no-cache-dir --no-deps --wheel-dir /app/wheels -r /dev/stdin |
| 39 | |
| 40 | |
| 41 | FROM python:3.14-slim AS runtime |
| 42 | |
| 43 | WORKDIR /app |
| 44 | |
| 45 | RUN groupadd -r musehub && useradd -r -g musehub musehub |
| 46 | |
| 47 | RUN apt-get update && apt-get install -y --no-install-recommends \ |
| 48 | libpq5 \ |
| 49 | && rm -rf /var/lib/apt/lists/* |
| 50 | |
| 51 | COPY --from=builder /app/wheels /wheels |
| 52 | RUN pip install --no-cache-dir /wheels/* |
| 53 | |
| 54 | COPY --chown=musehub:musehub musehub/musehub/ ./musehub/ |
| 55 | COPY --chown=musehub:musehub musehub/alembic/ ./alembic/ |
| 56 | COPY --chown=musehub:musehub musehub/alembic.ini musehub/pyproject.toml ./ |
| 57 | COPY --chown=musehub:musehub musehub/docs/ ./docs/ |
| 58 | COPY --chown=musehub:musehub musehub/deploy/ ./deploy/ |
| 59 | |
| 60 | COPY --chown=musehub:musehub musehub/entrypoint.sh ./entrypoint.sh |
| 61 | RUN chmod +x ./entrypoint.sh |
| 62 | |
| 63 | RUN mkdir -p /data && chown -R musehub:musehub /data && chmod 755 /data |
| 64 | |
| 65 | USER musehub |
| 66 | |
| 67 | ENV PYTHONPATH=/app |
| 68 | ENV PYTHONDONTWRITEBYTECODE=1 |
| 69 | ENV PYTHONUNBUFFERED=1 |
| 70 | |
| 71 | EXPOSE 1337 |
| 72 | |
| 73 | HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \ |
| 74 | CMD python3 -c "import urllib.request, ssl, os; url='https://localhost:1337/healthz' if os.path.exists('/tls/localhost.crt') else 'http://localhost:1337/healthz'; ctx=(lambda c: (setattr(c,'check_hostname',False), setattr(c,'verify_mode',ssl.CERT_NONE), c)[-1])(ssl.create_default_context()) if url.startswith('https') else None; r=urllib.request.urlopen(url, context=ctx); exit(0 if r.status==200 else 1)" || exit 1 |
| 75 | |
| 76 | ENTRYPOINT ["./entrypoint.sh"] |
File History
10 commits
sha256:0032d6cfa33bc3c8367436ad768e7dd0e339b4332153160247da8266cb5fa352
Merge branch 'task/version-tags-phase3-server' into dev
Human
17 days ago
sha256:4669620efda9ff41c55bdefd1f7bfe1c239d468428744c84ead9957e5a003a53
merge: rescue snapshot-recovery hardening (c00aa21d) into d…
Opus 4.8
minor
⚠
30 days ago
sha256:a59da49c4611b970fc4b6ae48678ce4943261c213a07ddbd73ce9201df869b4a
fix: remove false-positive proposal_comments index drop fro…
Sonnet 4.6
patch
34 days ago
sha256:0a240d6dbff234f07d98a28a4a9a68db702f3f9ff9260196f24219bdb1c0b6f3
feat: render markdown mists as HTML with heading anchor links
Sonnet 4.6
patch
34 days ago
sha256:24a7d47486ebc4ebd1832830580e177ec6f877b48dced8c000e198cdec4ce9d6
Merge 'task/bump-version-rc12' into 'dev' — proposal: Bump …
Human
36 days ago
sha256:b9ff931d147e0114a1f17060f415b89ed551c170a91ff226c70437aa5c85f9ee
Merge 'task/bump-version-rc12' into 'dev' — proposal: Bump …
Human
36 days ago
sha256:d1122d21e73471879b460037b22c0b50fded7c423444a176f248428f75dac39c
Merge 'task/fix-issue-pagination-cursor' into 'dev' — propo…
Human
36 days ago
sha256:01e18975e73d2b3cd5b6db7929c895bef9aa6e0d4391dc5b2adfc548b41318dd
Merge 'feat/adding-debug-logs-to-staging' into 'dev' — prop…
Human
36 days ago
sha256:6b1949fc2797ca4c1936a637a4cbfec828ef56cf52398a2e74ca3c4f494e728f
fix: use wire_bytes not mpack_bytes_raw in compute_object_b…
Sonnet 4.6
patch
48 days ago
sha256:b99f2455dc346966d040133f5203297e6e3ef5803a93728a2c30568d0a0f7583
rename: delta_add → delta_upsert across wire format, models…
Sonnet 4.6
patch
50 days ago