Dockerfile

# Isolate the build tools from the final runtime image to reduce size.
FROM python:3.11-slim-bookworm@sha256:04cd27899595a99dfe77709d96f08876bf2ee99139ee2f0fe9ac948005034e5b AS deps

# Pin the Poetry version for reproducibility.
ENV POETRY_VERSION=2.1.1 \
    POETRY_NO_INTERACTION=1

# Install Poetry using pip.
RUN pip install --no-cache-dir "poetry==$POETRY_VERSION"

# Set the working directory for the export process.
WORKDIR /export

# Copy only the dependency definition files.
COPY pyproject.toml poetry.lock ./

# Install the export plugin and generate the requirements.txt file.
RUN poetry self add poetry-plugin-export
RUN poetry export --without dev --format requirements.txt --output requirements.txt --without-hashes && sed -i '/python-magic-bin/d' requirements.txt

# Builds the final, lightweight production image.
FROM python:3.11-slim-bookworm@sha256:04cd27899595a99dfe77709d96f08876bf2ee99139ee2f0fe9ac948005034e5b AS runtime

# Metadata for image identification and maintenance contact.
LABEL maintainer="MortiScope Research Partners <mortiscope@gmail.com>" \
      version="1.0.0" \
      description="A backend API for a deep learning system that provides endpoints to analyze images of Chrysomya megacephala for Post-Mortem Interval (PMI) estimation."

# Set environment variables to optimize Python execution in containers.
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

# Install system-level libraries required for application features.
RUN apt-get update && apt-get install -y --no-install-recommends \
    libcairo2 \
    libffi-dev \
    libgdk-pixbuf2.0-0 \
    libpango-1.0-0 \
    libpangocairo-1.0-0 \
    libgl1 \
    libglib2.0-0 \
    libmagic1 \
    chromium \
    fonts-liberation \
    fontconfig \
    && rm -rf /var/lib/apt/lists/*

# Install custom fonts required for report generation and update the font cache.
COPY assets/fonts/ /usr/share/fonts/custom/
RUN fc-cache -f -v

# Copy the requirements file generated in the previous stage.
COPY --from=deps /export/requirements.txt /tmp/requirements.txt

# Install Python dependencies.
RUN pip install --no-cache-dir \
    torch torchvision \
    --index-url https://download.pytorch.org/whl/cpu \
    && pip install --no-cache-dir -r /tmp/requirements.txt \
    && rm /tmp/requirements.txt

# Create a non-root system user for security best practices.
RUN groupadd --system appgroup && useradd --system --gid appgroup appuser

# Set up the application directory structure.
WORKDIR /app

# Copy the application source code and data files.
COPY app/ ./app/
COPY data/ ./data/

# Create the artifacts directory for model storage and assign ownership to the non-root user.
RUN mkdir -p ./artifacts && chown -R appuser:appgroup /app

# Switch to the non-root user for execution.
USER appuser

# Document that the application listens on port 8000.
EXPOSE 8000

# Configure a health check to monitor API availability.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD ["sh", "-c", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/')\" || exit 1"]

# Define the command to start the ASGI server (Uvicorn).
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]