Aurora-Core/docker/api.Dockerfile

# syntax=docker/dockerfile:1
FROM python:3.12-slim AS base

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

RUN apt-get update \
    && apt-get install -y --no-install-recommends curl libpq5 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

FROM base AS builder
RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential libpq-dev \
    && rm -rf /var/lib/apt/lists/*
COPY pyproject.toml ./
COPY app ./app
# Editable install so site-packages resolves `app` by absolute path (/app)
# rather than a frozen copy — consistent with worker.Dockerfile, and keeps
# this correct even though uvicorn --reload happens to resolve its own
# import string against the CWD regardless.
RUN pip install --no-cache-dir -e .

# Builds the /wiki static site (mkdocs) in its own stage so mkdocs and its
# dependencies never end up in the runtime image -- only the rendered HTML
# does, copied in below.
FROM base AS docs-builder
RUN pip install --no-cache-dir mkdocs mkdocs-material
COPY mkdocs.yml ./
COPY docs ./docs
RUN mkdocs build --strict -d /wiki_site

FROM base AS runtime
RUN useradd --create-home --uid 1000 aurora
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin
COPY app ./app
COPY migrations ./migrations
COPY alembic.ini ./alembic.ini
COPY --from=docs-builder /wiki_site ./wiki
# Owned by aurora *before* the volume mount happens — see worker.Dockerfile
# for why (a fresh named volume otherwise defaults to root-owned, which the
# non-root `aurora` user below can't write into).
RUN mkdir -p /app/media && chown -R aurora:aurora /app/media

USER aurora

EXPOSE 8000

HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=5 \
    CMD curl -fsS http://localhost:8000/health || exit 1

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers"]