Dockerfile

FROM ubuntu:24.04 AS base

# Keeps Python from generating .pyc files in the container
ENV PYTHONDONTWRITEBYTECODE=1

# Turns off buffering for easier container logging
ENV PYTHONUNBUFFERED=1

ENV DEBIAN_FRONTEND=noninteractive

ENV BGE_EMBEDDINGS_MODEL_PATH=/embeddings_model/bge-small-en

RUN apt-get update && \
    apt-get install --no-install-recommends -y \
        ca-certificates \
        libmagic1 \
        # Dependency for opencv library
        libgl1 \
        && \
    apt-get install --no-install-recommends -y -t noble-backports \
        # Libreoffice is required for MS office documents
        libreoffice=4:25.8.7-0ubuntu0.25.10.1~bpo24.04.1 \
        && \
    # Cleanup apt cache in the same command to reduce size
    apt-get clean && rm -rf /var/lib/apt/lists/*


FROM base AS builder

# Getting uv from distroless docker
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

# Ubuntu 24.04 has python 3.12 by default
# We do not want to upgrade unstructured library for now,
# so we use uv to get python 3.11 while creating venv
ENV UV_PYTHON_INSTALL_DIR=/opt/uv/python
RUN uv python install 3.11

# Remove pip and setuptools from the uv managed python since we do not use them.
# The app runs from /opt/venv and uses uv/uvx, never pip, at runtime.
# pip 26.2.1 ships an embedded CycloneDX SBOM (bom.cdx.json) listing its vendored
# msgpack 1.1.2 and setuptools 70.3.0, which Trivy flags as HIGH
# (GHSA-6v7p-g79w-8964, CVE-2025-47273). Uninstalling pip cleanly removes the
# package, its dist-info, and the bin/pip* scripts in one step (plus the SBOM).
RUN /opt/uv/python/cpython-3.11-linux-x86_64-gnu/bin/python3.11 -m pip uninstall -y pip setuptools --break-system-packages

ENV VIRTUAL_ENV=/opt/venv
RUN uv venv "$VIRTUAL_ENV" --python 3.11 --relocatable --no-seed

ENV PATH="$VIRTUAL_ENV/bin:$PATH"

# Install pip requirements
COPY pyproject.toml poetry.lock ./

ENV POETRY=poetry@2.2.1
# uvx installs poetry in separate venv, not spoiling the app venv
RUN uvx "$POETRY" install --no-interaction --no-ansi --no-cache --only main --no-root --no-directory


FROM builder AS builder_download_nltk

# nltk stopwords and punkt_tab data is required for keywords search
RUN python -m nltk.downloader -d /usr/share/nltk_data stopwords punkt_tab


FROM builder AS builder_download_model

COPY download_model.py .

# Model: https://huggingface.co/epam/bge-small-en
RUN python download_model.py "epam/bge-small-en" "$BGE_EMBEDDINGS_MODEL_PATH" "openvino" "torch"


FROM builder AS builder_repo_digest

# Install git in builder to collect repository digest
RUN apt-get update && \
    apt-get install --no-install-recommends -y git

# Copy the whole repository
COPY . /opt/aidial_rag_repo
WORKDIR /opt/aidial_rag_repo

RUN python collect_repository_digest.py /opt/repository-digest.json


FROM builder_repo_digest AS test

COPY --from=builder_download_nltk /usr/share/nltk_data /usr/share/nltk_data
COPY --from=builder_download_model "$BGE_EMBEDDINGS_MODEL_PATH" "$BGE_EMBEDDINGS_MODEL_PATH"

RUN uvx "$POETRY" install --no-interaction --no-ansi --no-cache --with test --no-directory
RUN uvx "$POETRY" run pytest tests


FROM base

WORKDIR /

# Creates a non-root user with an explicit UID and adds permission to access the /app folder
# For more info, please refer to https://aka.ms/vscode-docker-python-configure-containers
RUN adduser -u 1001 --disabled-password --gecos "" appuser
USER appuser

COPY --from=builder --chown=appuser /opt/uv/python /opt/uv/python
COPY --from=builder --chown=appuser /opt/venv /opt/venv
COPY --from=builder_download_nltk --chown=appuser /usr/share/nltk_data /usr/share/nltk_data
COPY --from=builder_download_model --chown=appuser "$BGE_EMBEDDINGS_MODEL_PATH" "$BGE_EMBEDDINGS_MODEL_PATH"
COPY --chown=appuser ./config /config
COPY --chown=appuser ./aidial_rag /aidial_rag
COPY --from=builder_repo_digest --chown=appuser /opt/repository-digest.json /opt/repository-digest.json

ENV PATH="/opt/venv/bin:$PATH"

# Disable usage tracking for unstructured
ENV DO_NOT_TRACK=true

# Currently you cannot pass shrink_factor from unstructured.partition to sort_page_elements
# default value 0.9 cuts parts of the tables in 10k pdf document
ENV UNSTRUCTURED_XY_CUT_BBOX_SHRINK_FACTOR=1.0

ENV DIAL_RAG__CONFIG_PATH=/config/azure_description.yaml
ENV DIAL_RAG__INDEX_STORAGE__USE_DIAL_FILE_STORAGE=False
ENV ENABLE_DEBUG_COMMANDS=False

# During debugging, this entry point will be overridden. For more information, please refer to https://aka.ms/vscode-docker-python-debug
EXPOSE 5000
CMD ["uvicorn", "aidial_rag.main:app", "--host", "0.0.0.0", "--port", "5000"]