| # ============================================================================= | |
| # SimpleAudit Studio — single-container image (local `docker run` + HF Space) | |
| # | |
| # Single-process image: Django web + embedded Hatchet + worker in one Python | |
| # process. No Postgres, no supervisord, no external services. SQLite for the | |
| # domain DB, embedded Postgres (sidecar binary) for Hatchet's queue. | |
| # | |
| # The container listens on 7860 (Hugging Face Spaces expect that port). | |
| # | |
| # Build: docker build -t simpleaudit-studio . | |
| # Run: docker run -d -p 8000:7860 -v sa-data:/data --name simpleaudit-studio simpleaudit-studio | |
| # (web → http://localhost:8000, login studio / localdevpass123 — override with | |
| # -e BOOTSTRAP_PASSWORD=<strong> for anything shared) | |
| # All data (SQLite database, embedded queue, chat) lives in /data: mount a | |
| # named volume there to keep it across restarts and image updates. | |
| # ============================================================================= | |
| FROM python:3.12-slim AS base | |
| ENV PYTHONDONTWRITEBYTECODE=1 \ | |
| PYTHONUNBUFFERED=1 \ | |
| PIP_NO_CACHE_DIR=1 \ | |
| DJANGO_SETTINGS_MODULE=config.settings | |
| WORKDIR /app | |
| # --- System dependencies ----------------------------------------------------- | |
| # curl: healthchecks | |
| RUN apt-get update \ | |
| && apt-get install -y --no-install-recommends \ | |
| curl \ | |
| git \ | |
| && rm -rf /var/lib/apt/lists/* | |
| # --- Python dependencies ----------------------------------------------------- | |
| # pyproject.toml is the single source of truth; uv.lock pins exact versions. | |
| # uv sync creates /app/.venv; the PATH update keeps the `python` entrypoint. | |
| # The core (simpleaudit) is a PyPI dependency; uv sync pulls it from the | |
| # registry (no local checkout needed). | |
| COPY pyproject.toml uv.lock README.md ./ | |
| RUN pip install uv \ | |
| && uv sync --frozen --no-install-project --no-dev | |
| ENV PATH="/app/.venv/bin:$PATH" | |
| # --- Environment defaults ----------------------------------------------------- | |
| # SIMPLEAUDIT_MINIMAL=1 enables the single-process path (SQLite + embedded | |
| # Hatchet); SIMPLEAUDIT_DATA_DIR points everything (database, embedded queue, | |
| # chat) at /data so a mounted volume persists it. PORT=7860 is what Hugging | |
| # Face Spaces expect. Override via `docker run -e ...` or HF Space environment | |
| # variables for anything sensitive. | |
| # Must be set BEFORE collectstatic: Django settings select the DB engine from | |
| # it, and the postgres driver is an optional extra not installed in this image. | |
| ENV SIMPLEAUDIT_MINIMAL=1 \ | |
| PORT=7860 \ | |
| SIMPLEAUDIT_CHAT_PUBLIC_PORT=7860 \ | |
| SIMPLEAUDIT_CHAT_INTERNAL_PORT=8001 \ | |
| SIMPLEAUDIT_DATA_DIR=/data \ | |
| DJANGO_SECRET_KEY=hf-space-demo-secret-key-change-in-production \ | |
| DJANGO_DEBUG=false \ | |
| DJANGO_ALLOWED_HOSTS=* \ | |
| BOOTSTRAP_USERNAME=studio \ | |
| BOOTSTRAP_EMAIL=studio@example.local \ | |
| BOOTSTRAP_PASSWORD=localdevpass123 \ | |
| BOOTSTRAP_PROJECT_NAME=Default \ | |
| DEMO_MODE=true \ | |
| DEMO_USERNAME=studio \ | |
| DEMO_PASSWORD=localdevpass123 | |
| # --- Application code -------------------------------------------------------- | |
| COPY . . | |
| # Collect static files so Django can serve them without DEBUG. | |
| RUN python manage.py collectstatic --noinput | |
| # --- Non-root user ------------------------------------------------------------ | |
| # /data is where a mounted named volume persists all app data; it must exist | |
| # and be writable by appuser before the user switch. | |
| RUN useradd --create-home appuser \ | |
| && mkdir -p /app/staticfiles /data \ | |
| && chown -R appuser:appuser /app /data | |
| USER appuser | |
| EXPOSE 7860 | |
| HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=5 \ | |
| CMD curl -fsS http://localhost:7860/healthz || exit 1 | |
| # Model connections point at OpenAI's real base URL (https://api.openai.com/v1). | |
| # Users add their API key in the UI to run real audits. | |
| CMD ["python", "-m", "simpleaudit_studio.cli"] | |