| # syntax=docker/dockerfile:1 | |
| # | |
| # ============================================================================ | |
| # HUGGING FACE SPACE VARIANT — not the default build target. | |
| # | |
| # The harness/scoring image is `Dockerfile` at the repo root (ENTRYPOINT = | |
| # adapter.py, harness-facing /input -> /output contract) and stays the | |
| # default for `docker build .` / the scoring pipeline. This file only | |
| # exists so the orchestrator can assemble a separate Hugging Face Docker | |
| # Space repo that runs the judge-facing demo dashboard | |
| # (`routing_agent.webapp`) on the port Spaces expects (7860). | |
| # | |
| # This file is NOT deployed by this repo directly — see | |
| # `spaces/README.md` ("How the orchestrator assembles this Space repo") | |
| # and the main repo's `DEPLOYMENT.md` for the exact assembly + gated | |
| # deploy steps. When copied into the Space repo it must be renamed to | |
| # `Dockerfile` (HF Docker Spaces require that exact filename at the repo | |
| # root). | |
| # ============================================================================ | |
| # | |
| # Build steps below mirror the main Dockerfile (same base image, same uv | |
| # install method, same layer-caching order, same non-root user) so the | |
| # Space image has the same size/security posture as the harness image — | |
| # the only differences are the final PORT/EXPOSE/CMD, which run the demo | |
| # webapp instead of the adapter. | |
| FROM python:3.12-slim AS base | |
| # Copy the uv/uvx binaries from the official distroless uv image instead of | |
| # installing via pip or curl|sh — smaller, pinned, and avoids a build-time | |
| # network fetch script. | |
| COPY --from=ghcr.io/astral-sh/uv:0.11.18 /uv /uvx /usr/local/bin/ | |
| ENV UV_COMPILE_BYTECODE=1 \ | |
| UV_LINK_MODE=copy \ | |
| UV_PROJECT_ENVIRONMENT=/opt/venv \ | |
| PATH="/opt/venv/bin:$PATH" \ | |
| PYTHONUNBUFFERED=1 \ | |
| PYTHONDONTWRITEBYTECODE=1 | |
| WORKDIR /app | |
| # Install dependencies first (layer caching): only the `main` (default) | |
| # dependency group, never `dev` — no pytest/ruff/respx in the shipped image. | |
| COPY pyproject.toml uv.lock ./ | |
| RUN uv sync --frozen --no-install-project --no-dev | |
| # Now copy source and install the project itself. README.md is required by | |
| # hatchling (pyproject `readme` field) to build the project wheel. | |
| COPY README.md ./ | |
| COPY src/ ./src/ | |
| COPY evals/ ./evals/ | |
| RUN uv sync --frozen --no-dev | |
| # Non-root user — same posture as the harness image. Spaces containers do | |
| # not use the /input,/output volumes (those are the scoring harness's | |
| # contract), but keep the directories for parity / in case a judge runs | |
| # this image with `docker run -p ... <img> python -m routing_agent.adapter` | |
| # to sanity-check the harness path too. | |
| RUN groupadd --system app && useradd --system --gid app --home /app app \ | |
| && mkdir -p /input /output \ | |
| && chown -R app:app /app /input /output | |
| USER app | |
| # Hugging Face Docker Spaces always route traffic to port 7860 inside the | |
| # container (see spaces/README.md front-matter `app_port: 7860`). | |
| ENV PORT=7860 | |
| EXPOSE 7860 | |
| # Space-facing default: run the demo dashboard, not the harness adapter. | |
| CMD ["python", "-m", "routing_agent.webapp"] | |