| # AIOS web — the React shell + FastAPI over the platform data layer. THE CANONICAL IMAGE: | |
| # this is the one that actually runs, and the one a host migration re-points (C1e). | |
| # | |
| # ⛔ WHY A SECOND DOCKERFILE EXISTS (ops/Dockerfile.api), stated here so nobody "tidies" the wrong | |
| # one away. It is NOT a duplicated service — it is the SAME service built from a DIFFERENT BUILD | |
| # CONTEXT: | |
| # * HF Spaces: the context is the Space repo root, which `deploy_web.py` uploads FLATTENED — | |
| # `api/`, `web/`, `platform/`, `requirements.txt` all at top level. Hence the paths here. | |
| # * ops/compose.yml: the context is the local repo root, where the same files live at | |
| # `aios-web/api/`, `aios-web/web/`, `platform/`. Different prefixes, same content. | |
| # ⇒ THE REAL FIX, and it is a follow-up rather than something to do the day of a first deploy: | |
| # make `deploy_web.py` upload with the REPO layout so both contexts are identical, then this file | |
| # serves both and `ops/Dockerfile.api` is deleted. Until then `ops/verify_portability.py` gates | |
| # the two against each other on every property that matters (same app object, same launcher | |
| # contract, non-root, healthchecked, no baked secrets), so they cannot drift silently. | |
| # | |
| # Two stages: node builds the React bundle, python serves it + the JSON API. Login is the app's own | |
| # branded page over a signed session cookie (wave 1 removed the HTTP Basic gate). | |
| # ---- stage 1: build the React bundle ---- | |
| FROM node:22-slim AS web | |
| WORKDIR /web | |
| # Resolve deps FRESH from the public registry (the local lockfile pinned a mirror-only lodash | |
| # 4.18.1 that isn't on npmjs.org; a fresh install gets the public 4.17.x that glide accepts). | |
| COPY web/package.json ./ | |
| RUN npm install --no-audit --no-fund --no-package-lock | |
| COPY web/ ./ | |
| RUN rm -f package-lock.json && npm run build # -> /web/dist | |
| # ---- stage 2: python API serving the bundle ---- | |
| FROM python:3.12-slim | |
| WORKDIR /app | |
| COPY requirements.txt ./ | |
| RUN pip install --no-cache-dir -r requirements.txt | |
| COPY api/ ./api/ | |
| # the reused data layer (modules/core/harness) | |
| # ⛔ COMMENT ON ITS OWN LINE. Docker does NOT support a trailing comment on an instruction: | |
| # it parsed `# the reused data layer ...` as extra SOURCE PATHS and the first build ever run | |
| # died with `failed to calculate checksum ... "/the": not found`. Only RUN tolerates it, and | |
| # only because the shell eats the `#`. Gated in ops/verify_portability.py. | |
| COPY platform/ ./platform/ | |
| # the ephemeral-HF-Job scripts the API submits BY PATH (wave 31, R10/C5) | |
| # ⛔ WITHOUT THIS LINE THE DEPLOY UPLOADS jobs/ AND THE IMAGE STILL DOES NOT HAVE IT. Found at | |
| # wave 31 close: `deploy_web.py::_jobs_files()` was fixed to SHIP the two files, `--check` proved | |
| # `jobs=2`, and the container would still have answered "the browser job's script is missing from | |
| # this deployment" — because reaching the Space REPO and reaching the IMAGE are two different | |
| # things, and only this instruction does the second. Same shape as the manifest defect one layer | |
| # up: a file the product opens BY PATH is invisible to every import-following guard we own. | |
| COPY jobs/ ./jobs/ | |
| COPY --from=web /web/dist ./web/dist | |
| # Run unprivileged — the C2 security baseline, and matched to ops/Dockerfile.api so the two images | |
| # do not differ on a property that would only surface after a migration. uid 1000 is what HF | |
| # Spaces expects. | |
| RUN useradd --create-home --uid 1000 user && chown -R user:user /app | |
| USER user | |
| ENV RI_DIR=/app/platform \ | |
| PORT=7860 \ | |
| PYTHONUNBUFFERED=1 \ | |
| AIOS_PREWARM=1 | |
| # ⛔ AIOS_INSECURE_SSL is deliberately NOT set. It disables TLS verification for every outbound | |
| # call in the process and exists for one developer laptop. ops/verify_portability.py fails if any | |
| # deploy config sets it. | |
| EXPOSE 7860 | |
| # Liveness via stdlib rather than curl — it keeps the image free of an apt layer that exists only | |
| # for the healthcheck. | |
| HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \ | |
| CMD python -c "import os,urllib.request,sys; sys.exit(0 if urllib.request.urlopen(f'http://127.0.0.1:{os.environ.get(\"PORT\",\"7860\")}/api/health',timeout=4).status==200 else 1)" | |
| # ⚠ THE PORT COMES FROM THE ENVIRONMENT, ALWAYS. The application itself reads PORT nowhere — it is | |
| # a launcher argument — which is what makes moving hosts a config change instead of a code change. | |
| # Secrets (Odoo creds, APP_PASSWORD, AIOS_SESSION_SECRET, APP_BASE_URL) arrive as env at RUN time | |
| # and are never baked; the repo-root .dockerignore drops **/.env from the build context. | |
| CMD ["sh", "-c", "uvicorn api.main:app --host 0.0.0.0 --port ${PORT}"] | |