KryptoDB/Dockerfile at main · HarK-github/KryptoDB · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# syntax=docker/dockerfile:1.7
# ─────────────────────────────────────────────────────────────────────────────
# Stage 1 — Frontend builder
# ─────────────────────────────────────────────────────────────────────────────
FROM node:22.5.1-slim AS frontend-builder

WORKDIR /build/ui

# Install deps from lockfile only (reproducible)
COPY ui/package.json ui/package-lock.json ./
RUN npm ci --ignore-scripts

# Copy source and build in standalone mode
COPY ui/ ./
# NEXT_PUBLIC_KRYPTODB_URL is empty string intentionally:
# the browser hits the same origin (/api/* is proxied by Next.js)
ENV NEXT_PUBLIC_KRYPTODB_URL=""
ENV NEXT_TELEMETRY_DISABLED=1
RUN npm run build

# ─────────────────────────────────────────────────────────────────────────────
# Stage 2 — Python dependency builder
# ─────────────────────────────────────────────────────────────────────────────
FROM python:3.11.9-slim AS python-builder

WORKDIR /build

# Install build tools
RUN pip install --no-cache-dir build wheel

# Copy only dependency declaration first for layer caching
COPY pyproject.toml ./
# Stub the package so pip can resolve the install target
RUN mkdir -p kryptodb && touch kryptodb/__init__.py

RUN pip install --no-cache-dir --extra-index-url https://download.pytorch.org/whl/cpu --prefix=/install \
    fastapi "uvicorn[standard]" neo4j redis pydantic pydantic-settings \
    cryptography mcp fastmcp sentence-transformers langchain-core langchain-community \
    langchain-ollama langchain-openai langgraph langgraph-checkpoint-sqlite packaging python-dotenv textual trustcall

# ─────────────────────────────────────────────────────────────────────────────
# Stage 3 — Runtime image
# ─────────────────────────────────────────────────────────────────────────────
FROM python:3.11.9-slim AS runtime

LABEL org.opencontainers.image.title="KryptoDB"
LABEL org.opencontainers.image.description="Crypto-enforced, multi-agent memory substrate"
LABEL org.opencontainers.image.source="https://github.com/prolomaster/KryptoDB"

# Non-root user
RUN addgroup --system kryptodb && adduser --system --ingroup kryptodb --no-create-home kryptodb

WORKDIR /app

# Python packages from builder
COPY --from=python-builder /install /usr/local

# Application source (no .env, no test fixtures, no secrets)
COPY kryptodb/ ./kryptodb/
COPY data/ ./data/
COPY pyproject.toml ./

# Install the package in editable mode (uses kryptodb/ dir, no build artifacts)
RUN pip install --no-cache-dir packaging
RUN pip install --no-cache-dir --no-deps -e .

# Frontend — Next.js standalone build
COPY --from=frontend-builder /build/ui/.next/standalone ./ui-server/
COPY --from=frontend-builder /build/ui/.next/static ./ui-server/.next/static
COPY --from=frontend-builder /build/ui/public ./ui-server/public

# Writable runtime directory for audit archives and app-local state
RUN mkdir -p /data && chown kryptodb:kryptodb /data
VOLUME ["/data"]

# Entrypoint
COPY docker-entrypoint.sh ./
RUN chmod +x docker-entrypoint.sh

USER kryptodb

# Health check — FastAPI /health endpoint
HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"

EXPOSE 8000

# Default: web mode (FastAPI daemon, serves frontend static assets via /ui)
# MCP mode: docker run -i --rm ... kryptodb mcp
ENTRYPOINT ["./docker-entrypoint.sh"]
CMD ["web"]