Dockerfile

# syntax=docker/dockerfile:1
#
# Credenza — the Space Dockerfile. THIS FILE IS THE ENTIRE SPACE REPO, beside
# the HF card. It is one line on purpose.
#
# HF Docker Spaces show their source to anyone. Credenza's source is private
# (build spec §0), so nothing but this pull may live here — the app is baked
# into the image by deploy/Dockerfile.app. Adding a `COPY credenza/` line to
# this file would publish the application; deploy/deploy_to_hf.py has a test
# that fails if app source ever enters the sync payload.
#
# The `:654c4f780d7da47704f3cb67b27fbb070aca5d96` tag below is what a developer building this file locally gets.
# CI does NOT deploy it as written: `deploy_to_hf.py` rewrites the tag to the
# commit SHA before syncing.
#
# That is not tidiness. This file is the entire Space repo, so syncing it
# unchanged means committing bytes identical to the ones already there -- a
# no-op commit, no HF rebuild, and a Space that goes on serving the previous
# image while every gate in the pipeline reports success. It happened. Pinning
# the SHA gives the commit something to differ by, and names the exact image
# built from this source rather than whatever `:654c4f780d7da47704f3cb67b27fbb070aca5d96` resolves to at pull time.

FROM ghcr.io/cloudronin/credenza:654c4f780d7da47704f3cb67b27fbb070aca5d96