tools/hf_space/Dockerfile

# SimReady Validator — HuggingFace Space image
#
# Base: nvcr.io/nvidia/isaac-sim:4.5.0. Ships Kit at /isaac-sim/ so
# runner._kit_available() auto-selects --use-kit and the validator
# runs PhysX / MDL rules without a code change.
#
# UID 1000 is required by HF Spaces. The Isaac Sim base already has
# a user at UID 1000 (varies between releases — ubuntu / kit / etc.),
# so we REUSE it rather than create one. /app is the workspace dir
# with HOME=/app so Claude Code CLI finds skills under ~/.claude/skills
# regardless of the existing user's name.

FROM nvcr.io/nvidia/isaac-sim:4.5.0

# Skip interactive prompts during apt-get (the deadsnakes PPA install
# pulls tzdata in as a dep, which otherwise blocks the build asking
# for a geographic area).
ENV DEBIAN_FRONTEND=noninteractive
ENV TZ=Etc/UTC

# System deps (Ubuntu 22.04). Isaac Sim base may ship apt/pip configs
# pointing at NVIDIA-internal mirrors (urm.nvidia.com) that HF Spaces'
# build infra can't reach — wipe those before any install. The base
# default Python is 3.10; simready-validate requires >=3.11, so we
# install python3.11 from the deadsnakes PPA and use it explicitly
# for everything below.
RUN apt-get update && apt-get install -y --no-install-recommends \
        git curl ca-certificates rsync gnupg software-properties-common \
    && add-apt-repository -y ppa:deadsnakes/ppa \
    && apt-get update && apt-get install -y --no-install-recommends \
        python3.11 python3.11-venv python3.11-distutils \
    && curl -fsSL https://bootstrap.pypa.io/get-pip.py | python3.11 \
    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && rm -rf /var/lib/apt/lists/*

RUN npm config set registry https://registry.npmjs.org/ \
    && rm -f /root/.npmrc /etc/npmrc \
    && rm -f /root/.pip/pip.conf /etc/pip.conf

# Claude Code CLI.
RUN npm install -g --registry=https://registry.npmjs.org/ \
        @anthropic-ai/claude-code@latest

# Workspace nesting matches the legacy layout (/home/appuser/app)
# because runner.py uses Path(__file__).resolve().parents[2] to find
# tools/spec_sync/state.json — needs at least 3 levels of parent.
# We don't create the appuser account (UID 1000 already exists in the
# base image with a different name); we just use the path. HOME points
# at the workspace's parent so Claude Code CLI finds ~/.claude/skills.
RUN mkdir -p /home/appuser/app /home/appuser/.claude/skills
WORKDIR /home/appuser/app
ENV HOME=/home/appuser

# Python deps (system Python, public PyPI). --break-system-packages
# because Ubuntu 22.04 marks system Python as PEP-668 externally-
# managed; on a build-once container image that's the right trade-off.
COPY tools/hf_space/requirements.txt ./requirements.txt
RUN python3.11 -m pip install --no-cache-dir --break-system-packages \
        --index-url https://pypi.org/simple/ \
        -r requirements.txt

# Foundation specs.
ENV SIMREADY_FOUNDATIONS_PATH=/opt/simready_foundations
ENV SIMREADY_FOUNDATIONS_COMMIT=805d2c50179a9878c89b0f41baaa0ecafe47c3d7
RUN git clone https://github.com/NVIDIA/simready-foundation \
        ${SIMREADY_FOUNDATIONS_PATH} \
    && cd ${SIMREADY_FOUNDATIONS_PATH} \
    && git checkout ${SIMREADY_FOUNDATIONS_COMMIT}

# Vendored simready-foundation-core wheel.
COPY tools/hf_space/wheels/simready_foundation_core-0.2.0a1-py3-none-any.whl /tmp/
RUN python3.11 -m pip install --no-cache-dir --break-system-packages \
        --index-url https://pypi.org/simple/ \
        /tmp/simready_foundation_core-0.2.0a1-py3-none-any.whl \
    && rm /tmp/simready_foundation_core-0.2.0a1-py3-none-any.whl

# Validator + Space code.
COPY tools/validation /home/appuser/app/tools/validation
COPY tools/hf_space/app.py     ./app.py
COPY tools/hf_space/runner.py  ./runner.py
COPY tools/hf_space/github_issues.py ./github_issues.py
COPY tools/hf_space/agentic_issues.py ./agentic_issues.py
COPY README.md ./README.md
COPY VALIDATE.md ./VALIDATE.md

# Claude Code skills (HOME=/home/appuser → ~/.claude/skills).
COPY tools/hf_space/skills/simready-validator-agent /home/appuser/.claude/skills/simready-validator-agent
COPY tools/validation/plugins/simready-report/skills/simready-report /home/appuser/.claude/skills/simready-report

# UID 1000 owns the workspace + foundation clone.
RUN chown -R 1000:1000 /home/appuser ${SIMREADY_FOUNDATIONS_PATH}

# runner._kit_available() probes /isaac-sim/python.sh — present in the
# base image — so the validator auto-selects --use-kit at runtime.
# The validator's --use-kit path needs to know WHERE Kit's python lives;
# wire it via SIMREADY_KIT_PYTHON so the auto-detect is fully self-
# configuring (no per-call --kit-python flag needed).
ENV SIMREADY_KIT_PYTHON=/isaac-sim/python.sh

USER 1000:1000

ENV GRADIO_SERVER_NAME=0.0.0.0
ENV GRADIO_SERVER_PORT=7860
EXPOSE 7860

# Clear the Isaac Sim base's ENTRYPOINT (it runs /isaac-sim/runheadless.sh
# and treats CMD as its args — fails with 'Permission denied' under
# UID 1000). We invoke the Python app directly; Kit is invoked
# explicitly by the validator via /isaac-sim/python.sh when needed.
ENTRYPOINT []
CMD ["python3.11", "app.py"]