Dockerfile

# ── Base image ────────────────────────────────────────────────────────────────
FROM python:3.10.12-slim-bookworm

WORKDIR /app

# ── System dependencies ───────────────────────────────────────────────────────
# build toolchain for packages with C/Fortran extensions; OpenMP and BLAS for
# the numerical stack; pango/cairo/gdk-pixbuf/fontconfig for the PDF engine —
# without these the PDF renderer fails to import and downloads degrade to
# Markdown; curl for the health check; git for the hub client.
RUN apt-get update && apt-get install -y \
    build-essential \
    libgomp1 \
    libopenblas-dev \
    gfortran \
    curl \
    git \
    libpango-1.0-0 \
    libpangoft2-1.0-0 \
    libpangocairo-1.0-0 \
    libcairo2 \
    libgdk-pixbuf-2.0-0 \
    shared-mime-info \
    fontconfig \
    fonts-dejavu-core \
    && rm -rf /var/lib/apt/lists/*

# ── Python dependencies ───────────────────────────────────────────────────────
# pip check fails the build on a dependency conflict; the version assert fails
# it if the base image is ever not exactly 3.10.12.
COPY requirements.txt .
RUN python -m pip install --no-cache-dir --default-timeout=120 -r requirements.txt \
    && python -m pip check \
    && python -c "import sys; assert sys.version_info[:3] == (3, 10, 12), sys.version; print('Verified Python:', sys.version)"

# ── Bootstrap ─────────────────────────────────────────────────────────────────
# Only the launcher is baked into the image. The application and its artefacts
# are fetched at runtime from private repositories identified by secrets.
COPY bootstrap.py .

EXPOSE 8501

HEALTHCHECK --interval=30s --timeout=10s --start-period=120s --retries=3 \
    CMD curl --fail http://localhost:8501/_stcore/health || exit 1

ENTRYPOINT ["python", "bootstrap.py"]