Dockerfile

# syntax=docker/dockerfile:1.7
# =============================================================================
# OpenMRS AI Query Agent — production image
#
# Multi-stage: the builder carries compilers and build headers, the runtime
# carries neither. That keeps the shipped image small and, more importantly,
# removes a toolchain an attacker could use after a container compromise.
# =============================================================================

# -----------------------------------------------------------------------------
# Stage 1 — build the virtual environment
# -----------------------------------------------------------------------------
FROM python:3.12-slim-bookworm AS builder

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    PYTHONDONTWRITEBYTECODE=1

# build-essential is needed only if a dependency lacks a wheel for this
# platform; it never reaches the runtime stage.
RUN apt-get update \
 && apt-get install --no-install-recommends -y build-essential \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /build
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Dependency metadata is copied before the source so that editing application
# code does not invalidate the cached dependency install.
COPY pyproject.toml README.md ./
COPY src/oqa/__about__.py ./src/oqa/__about__.py

# ARG lets CI build a slimmer image for tests and a full one for release.
ARG EXTRAS="ai,rag,mcp,auth,reporting"
RUN --mount=type=cache,target=/root/.cache/pip \
    mkdir -p src/oqa \
 && touch src/oqa/__init__.py \
 && pip install --upgrade pip setuptools wheel \
 && pip install ".[${EXTRAS}]"

COPY src/ ./src/
RUN pip install --no-deps .

# -----------------------------------------------------------------------------
# Stage 2 — runtime
# -----------------------------------------------------------------------------
FROM python:3.12-slim-bookworm AS runtime

LABEL org.opencontainers.image.title="OpenMRS AI Query Agent" \
      org.opencontainers.image.description="Natural-language querying for OpenMRS and Bahmni clinical databases" \
      org.opencontainers.image.licenses="MPL-2.0" \
      org.opencontainers.image.source="https://github.com/openmrs/query-agent"

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONFAULTHANDLER=1 \
    PATH="/opt/venv/bin:$PATH" \
    OQA_LOG_FORMAT=json

# curl is present solely for the container healthcheck.
RUN apt-get update \
 && apt-get install --no-install-recommends -y curl \
 && rm -rf /var/lib/apt/lists/* \
 && groupadd --gid 10001 oqa \
 && useradd --uid 10001 --gid oqa --create-home --shell /usr/sbin/nologin oqa

COPY --from=builder --chown=root:root /opt/venv /opt/venv

WORKDIR /app
COPY --chown=oqa:oqa config/ /app/config/

# Writable location for cache and generated exports. Everything else in the
# image stays read-only, so the container can run with a read-only root
# filesystem plus a tmpfs or volume here.
RUN mkdir -p /app/.data /app/exports && chown -R oqa:oqa /app/.data /app/exports

USER oqa
EXPOSE 8000

# The liveness endpoint touches no dependency, so a healthy container is not
# marked unhealthy just because the database is briefly unreachable.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD curl --fail --silent http://localhost:8000/health/live || exit 1

# Invoke the project's own entrypoint rather than uvicorn directly. The uvicorn
# CLI has no way to say "use no logging configuration" (`--log-config /dev/null`
# makes it parse an empty file and abort), and structlog needs to own the log
# stream so that application and framework lines share one JSON format.
#
# Exec form: the process becomes PID 1 and receives SIGTERM directly, so
# in-flight requests drain instead of being killed.
CMD ["oqa", "serve", \
     "--host", "0.0.0.0", \
     "--port", "8000", \
     "--workers", "4", \
     "--graceful-timeout", "30"]