VectorMBE/Dockerfile at main · Georgefifth/VectorMBE · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# syntax=docker/dockerfile:1

# VectorMBE, built from source in one command.
#
#   docker build -t vectormbe .
#   docker run --rm -p 8080:8080 vectormbe
#
# Then open http://localhost:8080. The image carries the built web UI and the
# bundled demo model, so nothing has to be staged on the host first and there
# is nothing to configure. `Dockerfile.staged` is the production image and
# expects release artifacts to already exist on the build machine; this one
# does not.
#
# The build is not fast. `tch` pulls LibTorch (a few hundred MB) and the
# release profile compiles the whole workspace, so budget tens of minutes for
# a cold build. Layer caching makes rebuilds much cheaper.

# ── Stage 1: the web UI ──────────────────────────────────────────────────────
FROM node:20-bookworm-slim AS ui

WORKDIR /ui
# Dependencies first so a source-only edit does not re-run npm ci.
COPY ui/package.json ui/package-lock.json ./
RUN npm ci

COPY ui/ ./
# `npm run prebuild` expects this file to exist. The example maps the API to
# the same-origin `/api` prefix, which is exactly what the server below
# answers on, so the default needs no edit.
RUN cp public/env.runtime.js.example public/env.runtime.js
RUN npm run build

# ── Stage 2: the server ──────────────────────────────────────────────────────
FROM rust:1.94-bookworm AS server

RUN apt-get update && apt-get install -y --no-install-recommends \
        pkg-config libssl-dev unzip \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /src
COPY . .

RUN cargo build --release -p vectormbed

# `tch` downloads LibTorch into the torch-sys build directory rather than a
# system path, and vectormbed links against it dynamically, so the runtime
# stage needs those shared objects. Resolve the path rather than hardcoding
# the build hash, and fail loudly if it moves.
RUN set -eux; \
    mkdir -p /out/lib; \
    cp target/release/vectormbed /out/vectormbed; \
    LIBDIR="$(find target/release/build -type d -path '*/torch-sys-*/out/libtorch/libtorch/lib' | head -1)"; \
    test -n "$LIBDIR"; \
    cp "$LIBDIR"/*.so* /out/lib/

# ── Stage 3: runtime ─────────────────────────────────────────────────────────
FROM debian:bookworm-slim

# libgomp1 is required by LibTorch; poppler-utils backs PDF specification
# import, which fails at runtime rather than at build time without it.
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates libssl3 libgomp1 poppler-utils curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=server /out/vectormbed /app/vectormbed
COPY --from=server /out/lib/ /app/libtorch/lib/
COPY --from=ui /ui/dist/ /app/ui/
COPY data/demo/ /app/data/demo/

ENV LD_LIBRARY_PATH=/app/libtorch/lib \
    VECTORMBE_HOST=0.0.0.0 \
    VECTORMBE_PORT=8080 \
    VECTORMBE_UI_DIR=/app/ui \
    VECTORMBE_STARTUP_GRAPH=demo \
    VECTORMBE_DEFAULT_SAMPLE_PATH=/app/data/demo/aircraft_propulsion.json \
    VECTORMBE_REQUIRE_TORCH_GPU=false

# No API keys are set, so the server runs unauthenticated. That is right for a
# local demo container and wrong for anything reachable by other people: set
# VECTORMBE_ADMIN_KEY / _EDITOR_KEY / _VIEWER_KEY to turn authentication on.
EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl -sf http://localhost:8080/openapi.json || exit 1

CMD ["/app/vectormbed"]