quick commit

Dockerfile

@@ -1,27 +1,111 @@
-FROM python:3.11-slim
+# Multi-stage Docker build for GuardDen
+# This supports building with or without AI dependencies for smaller images
 
-WORKDIR /app
+# Stage 1: Base builder stage
+FROM python:3.11-slim as builder
 
-# Install system dependencies
+# Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
+    g++ \
     libpq-dev \
+    libffi-dev \
+    libssl-dev \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy all project files needed for installation
+# Set up Python environment
+RUN pip install --no-cache-dir --upgrade pip setuptools wheel
+
+# Copy project files for dependency installation
 COPY pyproject.toml README.md ./
 COPY src/ ./src/
 
-# Install Python dependencies (including AI packages)
-RUN pip install --no-cache-dir ".[ai]"
+# Install dependencies into a virtual environment
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
 
-# Copy remaining files
+# Build argument to control AI dependencies
+ARG INSTALL_AI=false
+
+# Install Python dependencies based on build argument
+RUN if [ "$INSTALL_AI" = "true" ]; then \
+        pip install --no-cache-dir ".[dev,ai]"; \
+    else \
+        pip install --no-cache-dir ".[dev]"; \
+    fi
+
+# Stage 2: Runtime stage
+FROM python:3.11-slim as runtime
+
+# Install runtime dependencies only
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq5 \
+    curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
+
+# Copy Python virtual environment from builder stage
+COPY --from=builder /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Create application directory
+WORKDIR /app
+
+# Copy application code
+COPY src/ ./src/
 COPY migrations/ ./migrations/
 COPY alembic.ini ./
+COPY pyproject.toml README.md ./
 
-# Create non-root user
-RUN useradd -m -u 1000 guardden && chown -R guardden:guardden /app
+# Create non-root user with specific UID/GID for security
+RUN groupadd -r -g 1000 guardden && \
+    useradd -r -u 1000 -g guardden -d /app -s /bin/bash guardden && \
+    chown -R guardden:guardden /app
+
+# Create directories for data and logs
+RUN mkdir -p /app/data /app/logs && \
+    chown -R guardden:guardden /app/data /app/logs
+
+# Switch to non-root user
 USER guardden
 
-# Run the bot
+# Add health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD curl -f http://localhost:8000/api/health || exit 1
+
+# Set environment variables
+ENV PYTHONUNBUFFERED=1
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV GUARDDEN_DATA_DIR=/app/data
+
+# Expose port for dashboard (if enabled)
+EXPOSE 8000
+
+# Default command
 CMD ["python", "-m", "guardden"]
+
+# Stage 3: Development stage (optional)
+FROM runtime as development
+
+# Switch back to root to install dev tools
+USER root
+
+# Install additional development tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    vim \
+    htop \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install development Python packages if not already installed
+RUN pip install --no-cache-dir \
+    pytest-xdist \
+    pytest-benchmark \
+    ipdb \
+    jupyter
+
+# Switch back to guardden user
+USER guardden
+
+# Override entrypoint for development
+CMD ["python", "-m", "guardden", "--dev"]