Dockerfile

# Production Dockerfile
# Builds frontend and backend into a single container image
# Usage: docker build -t openmlr . && docker run -p 3000:3000 openmlr

# ── Stage 1: Build frontend SPA ───────────────────────────
FROM node:20-slim AS frontend-build

WORKDIR /app

# Install pinned pnpm with disabled lifecycle scripts
RUN npm install -g --ignore-scripts pnpm@10.5.2

# Copy workspace lockfile and manifest for locked installation
COPY pnpm-workspace.yaml pnpm-lock.yaml package.json ./
COPY frontend/package.json ./frontend/
RUN pnpm --filter openmlr-frontend install --frozen-lockfile --ignore-scripts

# Copy frontend source and build production bundle
COPY frontend/ ./frontend/
RUN pnpm --filter openmlr-frontend build


# ── Stage 2: Python backend runtime ───────────────────────
FROM python:3.12-slim AS runtime

# System dependencies for asyncpg, lxml, cryptography, git
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential libpq-dev libxml2-dev libxslt1-dev curl git ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# Install uv package manager
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# Create non-root openmlr user
RUN groupadd --gid 1000 openmlr && \
    useradd --uid 1000 --gid openmlr --shell /bin/bash --create-home openmlr

WORKDIR /app

# Copy backend source and install dependencies from frozen lockfile
COPY backend/ ./backend/
RUN cd backend && uv sync --frozen --no-dev --no-install-project --no-build

# Copy built frontend static bundle
COPY --from=frontend-build /app/frontend/dist ./frontend/dist

# Create runtime directories with non-root ownership
RUN mkdir -p /app/data /app/.workspaces /app/.keys && chown -R openmlr:openmlr /app

# Switch to non-root user
USER openmlr

ENV PORT=3000
ENV PATH="/app/backend/.venv/bin:$PATH"
ENV PYTHONPATH="/app/backend"
EXPOSE 3000

CMD ["uvicorn", "openmlr.app:app", "--host", "0.0.0.0", "--port", "3000", "--app-dir", "backend"]