Upload 5 files

Dockerfile

@@ -1,16 +1,17 @@
-FROM docker.redpanda.com/redpandadata/redpanda:v23.3.11 AS redpanda
-FROM nginx:1.25-alpine AS final
+# Use Redpanda as the base — its binary needs /opt/redpanda/libexec at runtime
+# and cannot be copied into another image
+FROM docker.redpanda.com/redpandadata/redpanda:v23.3.11
 
-# ── Install Redpanda into nginx image ─────────────────────────────────────────
-COPY --from=redpanda /usr/bin/redpanda         /usr/bin/redpanda
-COPY --from=redpanda /usr/bin/rpk              /usr/bin/rpk
-COPY --from=redpanda /usr/lib/redpanda         /usr/lib/redpanda
-COPY --from=redpanda /etc/redpanda             /etc/redpanda
+USER root
 
-# ── Install runtime deps ───────────────────────────────────────────────────────
-RUN apk add --no-cache bash curl netcat-openbsd gettext
+# ── Install nginx + deps on top of the Redpanda (Debian-based) image ──────────
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    nginx \
+    curl \
+    netcat-openbsd \
+    && rm -rf /var/lib/apt/lists/*
 
-# ── Copy all config files from root ───────────────────────────────────────────
+# ── Copy all config files (flat root layout) ──────────────────────────────────
 COPY redpanda.yaml    /etc/redpanda/redpanda.yaml
 COPY nginx.conf       /etc/nginx/nginx.conf
 COPY start.sh         /start.sh
@@ -18,11 +19,22 @@ COPY init-topics.sh   /init-topics.sh
 
 RUN chmod +x /start.sh /init-topics.sh
 
-# ── Data dir ──────────────────────────────────────────────────────────────────
-RUN mkdir -p /var/lib/redpanda/data && \
-    chown -R 1000:1000 /var/lib/redpanda /etc/redpanda /start.sh /init-topics.sh
-
-# HF Spaces only exposes 7860 — everything goes through nginx
+# ── nginx needs these dirs writable by user 1000 ──────────────────────────────
+RUN mkdir -p /var/lib/redpanda/data \
+             /var/log/nginx \
+             /var/lib/nginx \
+             /run \
+    && chown -R 1000:1000 \
+             /var/lib/redpanda \
+             /etc/redpanda \
+             /var/log/nginx \
+             /var/lib/nginx \
+             /run \
+             /etc/nginx \
+             /start.sh \
+             /init-topics.sh
+
+# HF Spaces only exposes 7860 publicly
 EXPOSE 7860
 
 USER 1000

nginx.conf

@@ -1,6 +1,7 @@
 worker_processes auto;
 error_log /dev/stderr warn;
 pid /tmp/nginx.pid;
+worker_rlimit_nofile 8192;
 
 events {
     worker_connections 1024;
@@ -101,15 +102,3 @@ http {
         }
     }
 }
-
-# ── TCP stream proxy for native Kafka protocol (port 9092) ────────────────────
-# NOTE: HF Spaces only exposes port 7860 via HTTPS externally.
-# The Kafka binary protocol (TCP) requires a direct TCP connection.
-# Use the HTTP proxy paths above for external access.
-# For same-network (another HF Space or internal service), connect to :9092 directly.
-stream {
-    server {
-        listen     7861;
-        proxy_pass 127.0.0.1:9092;
-    }
-}

start.sh

@@ -32,6 +32,7 @@ until curl -sf http://127.0.0.1:9644/v1/status/ready > /dev/null 2>&1; do
     ATTEMPTS=$((ATTEMPTS+1))
     if [ $ATTEMPTS -gt 60 ]; then
         echo "ERROR: Redpanda failed to start after 120s"
+        kill $REDPANDA_PID 2>/dev/null || true
         exit 1
     fi
     echo "  ... waiting (${ATTEMPTS}/60)"
@@ -43,29 +44,30 @@ echo "  ✓ Redpanda ready"
 echo "[3/4] Initializing topics..."
 /init-topics.sh
 
-# ── 4. Start nginx (routes everything through port 7860) ─────────────────────
+# ── 4. Start nginx on :7860 ───────────────────────────────────────────────────
 echo "[4/4] Starting nginx on :7860..."
-nginx -g "daemon off;" &
+# Debian nginx binary lives at /usr/sbin/nginx
+# pid to /tmp — writable by uid 1000
+/usr/sbin/nginx -g "daemon off; pid /tmp/nginx.pid;" &
 NGINX_PID=$!
 
 echo ""
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "  ✅ All services up on port 7860"
 echo ""
-echo "  GET  /health              → broker status"
-echo "  *    /kafka/...           → HTTP REST proxy"  
-echo "  *    /admin/...           → admin API"
-echo "  *    /schema/...          → schema registry"
+echo "  GET  /health       → broker ready check"
+echo "  *    /kafka/...    → HTTP REST proxy (pandaproxy)"
+echo "  *    /admin/...    → admin API"
+echo "  *    /schema/...   → schema registry"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
-# ── Trap shutdown signals ─────────────────────────────────────────────────────
+# ── Graceful shutdown ─────────────────────────────────────────────────────────
 cleanup() {
     echo "Shutting down..."
-    kill $NGINX_PID 2>/dev/null || true
+    kill $NGINX_PID    2>/dev/null || true
     kill $REDPANDA_PID 2>/dev/null || true
     exit 0
 }
 trap cleanup SIGTERM SIGINT
 
-# ── Keep alive ────────────────────────────────────────────────────────────────
 wait $REDPANDA_PID