From 174fc8c52133493a8a0f69278ab9e6dcc35f1395 Mon Sep 17 00:00:00 2001 From: Fabian Gonzalez Date: Wed, 9 Sep 2026 10:28:32 -0400 Subject: [PATCH 1/2] migrate base image to chainguard + python package Signed-off-by: Fabian Gonzalez --- Dockerfile | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/Dockerfile b/Dockerfile index fe98581..4b1935e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,10 @@ # syntax=docker/dockerfile:1 +ARG BASE_IMAGE_REGISTRY=cgr.dev +ARG UV_VERSION=0.12.11 + +FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin + FROM node:26-bookworm-slim AS ui WORKDIR /build/ui COPY ui/package.json ui/package-lock.json ./ @@ -10,13 +15,19 @@ RUN npm rebuild esbuild COPY ui/ ./ RUN npm run build -FROM python:3.14-slim-bookworm +FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest + +ARG TOOLS_PYTHON_VERSION=3.14 +# Shared libraries the compiled wheels in the venv link against (scikit-learn and +# tokenizers need libstdc++); tzdata backs zoneinfo lookups. +RUN apk add --no-cache python-${TOOLS_PYTHON_VERSION} ca-certificates libstdc++ \ + zlib libffi sqlite-libs bzip2 xz tzdata WORKDIR /app # Install uv binary only (no pip); same approach as astral-sh/uv's Dockerfile. # https://github.com/astral-sh/uv/blob/6d889fd53d5c108d304c5a4085eb3140ec6a9cdb/Dockerfile#L21 -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=uv-bin /uv /usr/local/bin/uv COPY pyproject.toml uv.lock README.md ./ COPY packages ./packages @@ -31,15 +42,17 @@ COPY --from=ui /build/ui/dist ./src/agentevals/_static ARG VERSION ENV SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION} +ENV UV_PYTHON_PREFERENCE=only-system + RUN uv sync --frozen --no-dev --extra live --extra postgres --extra kubernetes \ # The runtime only uses the uv-managed venv; drop the base image's bundled # pip so its vendored packages (msgpack, pkg_resources) don't ship unused. - && rm -rf /usr/local/lib/python*/site-packages/pip \ - /usr/local/lib/python*/site-packages/pip-*.dist-info \ - /usr/local/bin/pip* \ - && ! /usr/local/bin/python -c "import pip" 2>/dev/null \ - && groupadd --gid 1000 app \ - && useradd --uid 1000 --gid app --home-dir /app --no-log-init app \ + && rm -rf /usr/lib/python*/site-packages/pip \ + /usr/lib/python*/site-packages/pip-*.dist-info \ + /usr/bin/pip* \ + && ! python3 -c "import pip" 2>/dev/null \ + && addgroup -g 1000 app \ + && adduser -u 1000 -G app -h /app -D -H app \ && chown -R app:app /app USER app From 2a975f60042d2512266af237d08ab2831e714178 Mon Sep 17 00:00:00 2001 From: Fabian Gonzalez Date: Thu, 10 Sep 2026 10:45:36 -0400 Subject: [PATCH 2/2] review comments: remove TOOLS_ prefix, scope UV_PYTHON_PREFERENCE to RUN, remove unecessary pip removal Signed-off-by: Fabian Gonzalez --- Dockerfile | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4b1935e..b909bf4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,10 +17,10 @@ RUN npm run build FROM ${BASE_IMAGE_REGISTRY}/chainguard/wolfi-base:latest -ARG TOOLS_PYTHON_VERSION=3.14 +ARG PYTHON_VERSION=3.14 # Shared libraries the compiled wheels in the venv link against (scikit-learn and # tokenizers need libstdc++); tzdata backs zoneinfo lookups. -RUN apk add --no-cache python-${TOOLS_PYTHON_VERSION} ca-certificates libstdc++ \ +RUN apk add --no-cache python-${PYTHON_VERSION} ca-certificates libstdc++ \ zlib libffi sqlite-libs bzip2 xz tzdata WORKDIR /app @@ -42,15 +42,8 @@ COPY --from=ui /build/ui/dist ./src/agentevals/_static ARG VERSION ENV SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION} -ENV UV_PYTHON_PREFERENCE=only-system - -RUN uv sync --frozen --no-dev --extra live --extra postgres --extra kubernetes \ - # The runtime only uses the uv-managed venv; drop the base image's bundled - # pip so its vendored packages (msgpack, pkg_resources) don't ship unused. - && rm -rf /usr/lib/python*/site-packages/pip \ - /usr/lib/python*/site-packages/pip-*.dist-info \ - /usr/bin/pip* \ - && ! python3 -c "import pip" 2>/dev/null \ +RUN UV_PYTHON_PREFERENCE=only-system \ + uv sync --frozen --no-dev --extra live --extra postgres --extra kubernetes \ && addgroup -g 1000 app \ && adduser -u 1000 -G app -h /app -D -H app \ && chown -R app:app /app