Aurora-Core/docker/worker.Dockerfile

# syntax=docker/dockerfile:1
FROM python:3.12-slim AS base

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

RUN apt-get update \
    && apt-get install -y --no-install-recommends libpq5 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

FROM base AS builder
RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential libpq-dev \
    && rm -rf /var/lib/apt/lists/*
COPY pyproject.toml ./
COPY app ./app
# Editable install: site-packages ends up pointing at this /app directory by
# absolute path rather than a frozen copy of it. That matters because the
# `arq` console-script (unlike uvicorn --reload, which explicitly resolves
# its app import against the CWD) just imports whatever site-packages says
# `app` is — a non-editable install would permanently freeze the worker's
# code at whatever this build saw, silently ignoring the dev bind mount
# (docker-compose.yml's `./app:/app/app`) on every later `restart`.
RUN pip install --no-cache-dir -e .

FROM base AS runtime
RUN useradd --create-home --uid 1000 aurora
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin
COPY app ./app
# Owned by aurora *before* the volume mount happens: Docker populates a
# fresh named volume (docker-compose.yml's aurora_media_data) from whatever
# already exists at its mount point in the image, ownership included. Skip
# this and a brand-new volume defaults to root-owned, which the non-root
# `aurora` user below can't write into.
RUN mkdir -p /app/media && chown -R aurora:aurora /app/media

USER aurora

CMD ["arq", "app.workers.worker.WorkerSettings"]