Dockerfile

# ---------------------------------------------------------------------------
# Build stage: the internal WhatsApp service (Go / whatsmeow).
# The binary is built here (CGO + libjpeg/libwebp headers) and embedded in the
# runtime image as a sibling process started by start.sh. Runtime configuration
# is NOT baked in: the Go service receives every setting as an environment
# variable injected by the deployment platform / start.sh (single source of
# truth = the main application's environment / .env). The Go module requires
# Go 1.25.
#
# IMPORTANT: the build image MUST be glibc-based (bookworm), NOT Alpine. The
# CGO build links against glibc; a binary built on Alpine (musl) cannot be
# executed by the Debian runtime image ("cannot execute: required file not
# found").
# ---------------------------------------------------------------------------
FROM golang:1.25.0-bookworm AS whatsapp-build

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    git \
    libjpeg62-turbo-dev \
    libwebp-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

COPY whatsapp-service/go.mod whatsapp-service/go.sum ./
RUN go mod download

COPY whatsapp-service/ .

ARG WHATSAPP_VERSION=dev
RUN CGO_ENABLED=1 go build -ldflags "-X main.version=${WHATSAPP_VERSION}" -o server ./cmd/agentdeck-whatsapp-service

# ---------------------------------------------------------------------------
# Runtime image
# ---------------------------------------------------------------------------
FROM python:3.11-slim

LABEL maintainer="AgentDeck-Backend"
LABEL description="AgentDeck-Backend"
LABEL version="1.0.0"

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    curl \
    ffmpeg \
    git \
    libmagic1 \
    libxml2-dev \
    libxslt-dev \
    libffi-dev \
    libssl-dev \
    nodejs \
    zlib1g-dev \
    # Runtime libs for the embedded WhatsApp (Go) service: media codecs and
    # timezone data required by whatsmeow/ffmpeg processing.
    libjpeg62-turbo \
    libwebp7 \
    poppler-utils \
    tzdata \
    # Runtime libs for PaddleOCR / opencv-contrib-python (cv2), mirroring the
    # reference reconciliation-file-processing-service Dockerfile.
    libglib2.0-0 \
    libsm6 \
    libxext6 \
    libxrender-dev \
    libgomp1 \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd --gid 1000 appuser && \
    useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt --extra-index-url https://download.pytorch.org/whl/cpu && \
    python -m spacy download en_core_web_sm

# SearXNG uses a rolling release model — master branch is the intended stable channel
RUN git clone --depth 1 --branch master https://github.com/searxng/searxng.git /tmp/searxng && \
    cd /tmp/searxng && \
    pip install --no-cache-dir --use-pep517 --no-build-isolation -e . && \
    rm -rf /tmp/searxng/.git

COPY --chown=appuser:appuser . .

# Replace the WhatsApp service source tree (copied above from the repo) with
# just the compiled binary + VERSION baked from the whatsapp-build stage.
RUN rm -rf /app/whatsapp-service
COPY --from=whatsapp-build /build/server /app/whatsapp-service/server
COPY --from=whatsapp-build /build/VERSION /app/whatsapp-service/VERSION
RUN chmod +x /app/whatsapp-service/server

RUN mkdir -p /app/models && python3 -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='ibm-granite/granite-embedding-small-english-r2', local_dir='/app/models/bge-384')" && chown -R appuser:appuser /app/models

# DEPRECATED: PyTorch (torch) backend -- restore to roll back:
# RUN mkdir -p /app/models && python3 -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='fastino/gliner2-base-v1', local_dir='/app/models/gliner2-base-v1')" && chown -R appuser:appuser /app/models

# Pre-download the local on-device extraction model (used by /json/feature-extract)
# so first boot does not hit Hugging Face. The GLINER_MODEL env below points the
# service at this local copy.
RUN mkdir -p /app/models && python3 -c "from huggingface_hub import snapshot_download; snapshot_download(repo_id='lion-ai/gliner2-base-v1-onnx', local_dir='/app/models/gliner2-base-v1-onnx')" && chown -R appuser:appuser /app/models

RUN mkdir -p /app/data /app/logs && \
    chown -R appuser:appuser /app/data /app/logs

RUN chmod +x /app/start.sh

USER appuser

ENV PYTHONPATH=/app
ENV PYTHONUNBUFFERED=1

# Local copy of the on-device extraction model baked in at build time.
ENV GLINER_MODEL=/app/models/gliner2-base-v1-onnx
# DEPRECATED: PyTorch (torch) backend -- restore to roll back:
# ENV GLINER_MODEL=/app/models/gliner2-base-v1

# Path to the embedded WhatsApp service binary (started by start.sh as a
# sibling process). Set to an empty value to disable the WhatsApp gateway.
# The Go service reads all runtime settings (SUPABASE_URL, SUPABASE_DB_URL,
# REDIS_URL, GLOBAL_API_KEY, ...) from the environment injected by the
# platform / start.sh — no .env is shipped for it. All values live in the
# main application's centralized configuration (see .env.example).
ENV WHATSAPP_SERVICE_BINARY=/app/whatsapp-service/server

EXPOSE 7860

HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:7860/health')" || exit 1

CMD ["/bin/bash", "/app/start.sh"]