FROM ghcr.io/astral-sh/uv:0.12.19@sha256:04d046b13e60d6bcec73cbc5e1cad25d680dea90c8573340950a0ac2d1aef424 AS uv
FROM ubuntu:24.04@sha256:a853f94d226358a79c740cfc7bce0c289748f3fe3488d921d038ccd752c61b60 AS runtime-toolchain

RUN apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \
      ca-certificates git gcc g++ clang binutils make && \
    dpkg-query -W > /opt/apt-packages.txt && rm -rf /var/lib/apt/lists/*
# The private native helper is built only after the authenticated startup fetch.
# Keep the large public LLVM development toolchain in a separately cached layer.
RUN apt-get update && \
    DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \
      llvm-18-dev libclang-18-dev libclang-cpp18-dev && \
    dpkg-query -W > /opt/apt-packages.txt && rm -rf /var/lib/apt/lists/*

FROM runtime-toolchain
COPY --from=uv /uv /uvx /usr/local/bin/
ENV UV_PYTHON_INSTALL_DIR=/opt/python UV_LINK_MODE=copy
RUN useradd -o -m -u 1000 user && \
    uv python install 3.11.13 && uv venv --python 3.11.13 /opt/venv && \
    chown -R user:user /opt/venv
COPY requirements-runtime.txt /opt/requirements-runtime.txt
USER user
ENV HOME=/home/user UV_CACHE_DIR=/home/user/.cache/uv
RUN --mount=type=cache,id=decompile-verify-gradio-uv,target=/home/user/.cache/uv,uid=1000,gid=1000 \
    uv pip sync --python /opt/venv/bin/python --require-hashes /opt/requirements-runtime.txt
ENV PATH="/opt/venv/bin:$PATH" PYTHONHASHSEED=0 PYTHONUNBUFFERED=1 GRADIO_ANALYTICS_ENABLED=False
WORKDIR /home/user/app
# Do not COPY the build context as a whole: it may have an initialized private submodule.
COPY --chown=user:user demo/ ./demo/
COPY --chown=user:user bootstrap.py core-revision.json ./
EXPOSE 7860
CMD ["python", "bootstrap.py"]