Dockerfile.redhat

#
# Copyright (c) 2020-2023 Intel Corporation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

ARG BASE_IMAGE=registry.access.redhat.com/ubi9/ubi:9.7
ARG BUILD_IMAGE=build
ARG PKG_IMAGE=pkg
ARG RELEASE_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-minimal:9.7

FROM $BASE_IMAGE as base_build
ARG BASE_IMAGE=registry.access.redhat.com/ubi9/ubi:9.7

SHELL ["/bin/bash", "-xo", "pipefail", "-c"]

ARG JOBS=8
ARG VERBOSE_LOGS=OFF
ARG LTO_ENABLE=OFF
ARG LTO_CXX_FLAGS=""
ARG LTO_LD_FLAGS="-Wl,-z,relro"

# hadolint ignore=DL3041
RUN echo -e "max_parallel_downloads=8\nretries=50" >> /etc/dnf/dnf.conf && \
    dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && dnf update -d6 -y && dnf install -d6 -y \
            libuuid-devel \
            bc \
            cmake \
            gcc-c++ \
            git \
            libcurl-devel \
            libtool \
            libxml2-devel \
            make \
            openssl-devel \
            patch \
            pkg-config \
            wget && \
            dnf clean all

####### Azure SDK needs new boost:
WORKDIR /boost
# hadolint ignore=DL3003
RUN wget -nv https://sourceforge.net/projects/boost/files/boost/1.68.0/boost_1_68_0.tar.gz && \
	if [ "$VERBOSE_LOGS" == "ON" ] ; then export BVERBOSE="-d+2" ; else export BVERBOSE="" ; fi && \
	tar xf boost_1_68_0.tar.gz && cd boost_1_68_0 && ./bootstrap.sh && \
	./b2 -j ${JOBS} cxxstd=17 link=static variant=release \
		cxxflags="-fPIC $LTO_CXX_FLAGS" \
		cflags="-fPIC $LTO_CXX_FLAGS" \
		linkflags="$LTO_LD_FLAGS" \
		--with-chrono --with-date_time --with-filesystem \
		--with-program_options --with-system \
		--with-random --with-thread --with-atomic --with-regex \
		--with-log --with-locale "$BVERBOSE" \
		install

COPY third_party/pugixml /ovms/third_party/pugixml

# Build and install pugixml
# hadolint ignore=DL3003
RUN git clone -b v1.13 https://github.com/zeux/pugixml && \
    cd pugixml && \
    patch -p1 < /ovms/third_party/pugixml/pugixml_v1.13_flags.patch && \
    cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_VERBOSE_MAKEFILE=${VERBOSE_LOGS} \
    -DCMAKE_CXX_FLAGS="${LTO_CXX_FLAGS}" \
    -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" && \
    make all -j ${JOBS} && \
    cp -P libpugixml.so* /usr/lib64/

####### Azure SDK
WORKDIR /azure
COPY third_party/azure /ovms/third_party/azure
COPY third_party/cpprest /ovms/third_party/cpprest
RUN git clone --recurse-submodules --depth 1 --branch v2.10.16 https://github.com/Microsoft/cpprestsdk.git && \
    git clone --depth 1 --branch v7.5.0 https://github.com/Azure/azure-storage-cpp.git && \
    patch -d /azure/cpprestsdk/ -p1 < /ovms/third_party/cpprest/rest_sdk_v2.10.16.patch && \
    patch -d /azure/azure-storage-cpp/ -p1 </ovms/third_party/azure/azure_sdk.patch

WORKDIR /azure/cpprestsdk/Release/build.release
ARG SDL_OPS="-Wl,-z,relro,-z,now,-z,noexecstack -Wall -Wextra -Wimplicit-fallthrough -fPIE -pie -fstack-protector-strong -fexceptions -fasynchronous-unwind-tables -fcf-protection -fpic -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fno-strict-overflow -Wall -Wno-unknown-pragmas -Wno-error=sign-compare -fno-delete-null-pointer-checks -fwrapv -fstack-clash-protection -Wformat -Wformat-security -Werror=format-security -s -D_GLIBCXX_USE_CXX11_ABI=1 -Wuninitialized"
RUN cmake .. -DCMAKE_VERBOSE_MAKEFILE=${VERBOSE_LOGS} -DCMAKE_CXX_FLAGS="${SDL_OPS} ${LTO_CXX_FLAGS}" -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON -DBoost_USE_STATIC_RUNTIME=ON -DBoost_USE_STATIC_LIBS=ON -DWERROR=OFF -DBUILD_SAMPLES=OFF -DBUILD_TESTS=OFF && make --jobs=$JOBS install

WORKDIR /azure/azure-storage-cpp/Microsoft.WindowsAzure.Storage/build.release
RUN CASABLANCA_DIR=/azure/cpprestsdk cmake .. -DCMAKE_CXX_FLAGS="${SDL_OPS} ${LTO_CXX_FLAGS}" -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON -DBoost_USE_STATIC_RUNTIME=ON -DBoost_USE_STATIC_LIBS=ON -DCMAKE_VERBOSE_MAKEFILE=${VERBOSE_LOGS} && make --jobs=$JOBS && make --jobs=$JOBS install
####### End of Azure SDK

####### Build OpenCV
COPY third_party/opencv /ovms/third_party/opencv
WORKDIR /ovms/third_party/opencv
RUN if [ "$VERBOSE_LOGS" == "ON" ] ; then export VERBOSE=1 ; fi && ./install_opencv.sh
####### End of OpenCV

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #
FROM base_build as build
ARG BASE_IMAGE

SHELL ["/bin/bash", "-xo", "pipefail", "-c"]

ARG JOBS=40
ARG VERBOSE_LOGS=OFF
ARG LTO_ENABLE=OFF

# hadolint ignore=DL3041
RUN dnf install -y -d6 \
            https://vault.centos.org/centos/8-stream/PowerTools/x86_64/os/Packages/opencl-headers-2.2-1.20180306gite986688.el8.noarch.rpm \
            gdb \
            java-11-openjdk-devel \
            tzdata-java \
            libgusb.x86_64 \
            libusbx \
            libtool \
            openssl-devel \
            which \
            unzip \
            vim \
            xz \
            python3.12 \
            python3.12-devel \
            python3.12-pip \
            libicu-devel && \
            dnf clean all

WORKDIR /

ARG INSTALL_DRIVER_VERSION="24.52.32224"
# GPU testing in build img & remote tensors dependencies
WORKDIR /usr/lib64/
RUN ln -s libOpenCL.so.1 libOpenCL.so
WORKDIR /ovms
COPY ./install_redhat_gpu_drivers.sh ./install_gpu_drivers.sh
# hadolint ignore=SC1091
RUN wget -q https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/libva-devel-2.22.0-1.el9.x86_64.rpm && \
    rpm -ivh --nodeps ./libva-devel-2.22.0-1.el9.x86_64.rpm && \
    if [ -f /usr/bin/dnf ] ; then export DNF_TOOL=dnf ; echo -e "max_parallel_downloads=8\nretries=50" >> /etc/dnf/dnf.conf ; else export DNF_TOOL=microdnf ; fi ; source ./install_gpu_drivers.sh && \
    groupadd --gid 5000 ovms && groupadd --gid 44 video1 && \
    useradd --home-dir /home/ovms --create-home --uid 5000 --gid 5000 --groups 39,44 --shell /bin/bash --skel /dev/null ovms

RUN python3.12 --version && python3.12 -m pip install "numpy<2.0.0" "Jinja2==3.1.6" "MarkupSafe==3.0.2"  --no-cache-dir

# Set up Bazel
ENV BAZEL_VERSION 6.1.1
WORKDIR /bazel
RUN curl -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36" -fSsL -O https://github.com/bazelbuild/bazel/releases/download/$BAZEL_VERSION/bazel-$BAZEL_VERSION-installer-linux-x86_64.sh && \
    curl -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36" -fSsL -o /bazel/LICENSE.txt https://raw.githubusercontent.com/bazelbuild/bazel/master/LICENSE && \
    chmod +x bazel-*.sh && \
    ./bazel-$BAZEL_VERSION-installer-linux-x86_64.sh && \
    rm -f /bazel/bazel-$BAZEL_VERSION-installer-linux-x86_64.sh

RUN  dnf install -y https://github.com/linux-test-project/lcov/releases/download/v1.16/lcov-1.16-1.noarch.rpm && dnf clean all

ENV TF_SYSTEM_LIBS="curl"
ENV TEST_LOG="/root/.cache/bazel/_bazel_root/bc57d4817a53cab8c785464da57d1983/execroot/ovms/bazel-out/test.log"
ARG ov_source_branch=c01cd93e24d1cd78bfbb401eed51c08fb93e0816
ARG ov_source_org=openvinotoolkit
ARG ov_use_binary=0
ARG DLDT_PACKAGE_URL
ARG TEMP_DIR=/tmp/openvino_installer
ARG CMAKE_BUILD_TYPE=Release
ARG debug_bazel_flags="--strip=always  --config=mp_on_py_on --//:distro=redhat"

RUN alternatives --install /usr/bin/python3 python3 /usr/bin/python3.12 1 && alternatives --install /usr/bin/python3-config python3-config /usr/bin/python3.12-config 2

################### BUILD OPENVINO FROM SOURCE - buildarg ov_use_binary=0  ############################
ARG SDL_OPS="-Wl,-z,relro,-z,now,-z,noexecstack -fPIE -pie -fstack-protector-strong -fexceptions -fasynchronous-unwind-tables -fcf-protection -fpic -O2 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fno-strict-overflow -Wno-unknown-pragmas -Wno-error=sign-compare -fno-delete-null-pointer-checks -fwrapv -fstack-clash-protection -Wformat -Wformat-security -s -D_GLIBCXX_USE_CXX11_ABI=1 -Wuninitialized"
# hadolint ignore=DL3041
RUN dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && dnf install -y gflags-devel gflags json-devel fdupes && \
    dnf clean all
# hadolint ignore=DL3003
RUN if [ "$ov_use_binary" == "0" ] ; then true ; else exit 0 ; fi ; git clone https://github.com/$ov_source_org/openvino.git /openvino && cd /openvino && git checkout $ov_source_branch && git submodule update --init --recursive
RUN if [ "$ov_use_binary" == "0" ]; then true ; else exit 0 ; fi ; if ! [[ $debug_bazel_flags == *"py_off"* ]]; then true ; else exit 0 ; fi ; pip3.12 install --no-cache-dir -r /openvino/src/bindings/python/wheel/requirements-dev.txt
WORKDIR /openvino/build
RUN if [ "$ov_use_binary" == "0" ]; then true ; else exit 0 ; fi ; \
    if ! [[ $debug_bazel_flags == *"py_off"* ]]; then \
        cmake -DCMAKE_BUILD_TYPE=$CMAKE_BUILD_TYPE -DCMAKE_VERBOSE_MAKEFILE="${VERBOSE_LOGS}" -DENABLE_LTO=${LTO_ENABLE} -DENABLE_PYTHON=ON -DENABLE_SAMPLES=0 -DENABLE_INTEL_NPU=OFF -DCMAKE_CXX_FLAGS="  ${SDL_OPS} -Wno-error=parentheses  ${LTO_CXX_FLAGS} " -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" .. ; \
    else \
        cmake -DCMAKE_BUILD_TYPE=$CMAKE_BUILD_TYPE -DCMAKE_VERBOSE_MAKEFILE="${VERBOSE_LOGS}" -DENABLE_LTO=${LTO_ENABLE} -DENABLE_SAMPLES=0 -DENABLE_INTEL_NPU=OFF -DCMAKE_CXX_FLAGS="  ${SDL_OPS} -Wno-error=parentheses ${LTO_CXX_FLAGS} " -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" .. ; \
    fi && \
    make --jobs=$JOBS && \
    make install
RUN if [ "$ov_use_binary" == "0" ] ; then true ; else exit 0 ; fi ; \
    mkdir -p /opt/intel/openvino/extras && \
    mkdir -p /opt/intel/openvino && \
    ln -s /openvino/inference-engine/temp/opencv_*/opencv /opt/intel/openvino/extras && \
    ln -s /usr/local/runtime /opt/intel/openvino && \
    ln -s /openvino/scripts/setupvars/setupvars.sh /opt/intel/openvino/setupvars.sh && \
    ln -s /opt/intel/openvino /opt/intel/openvino_2026
RUN if [ "$ov_use_binary" == "0" ]; then true ; else exit 0 ; fi ; if ! [[ $debug_bazel_flags == *"py_off"* ]]; then true ; else exit 0 ; fi ; mkdir -p /opt/intel/openvino && cp -r /openvino/bin/intel64/Release/python /opt/intel/openvino/
RUN if [ "$ov_use_binary" == "0" ]; then true ; else exit 0 ; fi ; if ! [[ $debug_bazel_flags == *"py_off"* ]]; then true ; else exit 0 ; fi ; cp -r /openvino/tools/ovc/* /opt/intel/openvino/python
################## END OF OPENVINO SOURCE BUILD ######################

################### TAKE OPENVINO FROM A BINARY RELEASE - buildarg ov_use_binary=1 (DEFAULT) ##########
WORKDIR $TEMP_DIR
# OV toolkit package
RUN if [ "$ov_use_binary" = "1" ] && [ "$DLDT_PACKAGE_URL" != "" ]; then true ; else exit 0 ; fi ; \
    wget -nv $DLDT_PACKAGE_URL && \
    mkdir /opt/intel && \
    tar -zxf ./*openvino_genai*.tar.gz -C /opt/intel && \
    ln -s /opt/intel/*openvino_genai* /opt/intel/openvino && \
    ln -s /opt/intel/*openvino_genai* /opt/intel/openvino_2026

# install sample apps including benchmark_app
# hadolint ignore=DL3041
RUN dnf install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && dnf install -y gflags-devel gflags json-devel && \
    dnf clean all
RUN if [ -f /opt/intel/openvino/samples/cpp/build_samples.sh ];  then /opt/intel/openvino/samples/cpp/build_samples.sh ; fi
#################### END OF OPENVINO BINARY INSTALL

# OpenVINO Tokenizers extension
ENV OpenVINO_DIR=/opt/intel/openvino/runtime/cmake
ENV OPENVINO_TOKENIZERS_PATH_GENAI=/opt/intel/openvino/runtime/lib/intel64/libopenvino_tokenizers.so
ENV LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:/opt/intel/openvino/runtime/lib/intel64/:/opt/opencv/lib/:/opt/intel/openvino/runtime/3rdparty/tbb/lib/

WORKDIR /openvino_tokenizers/
ARG ov_tokenizers_branch=85be884a69f10270703f81f970a5ee596a4c8df7
ARG ov_tokenizers_org=openvinotoolkit
# hadolint ignore=DL3003
RUN git clone https://github.com/$ov_tokenizers_org/openvino_tokenizers.git /openvino_tokenizers && cd /openvino_tokenizers && git checkout $ov_tokenizers_branch && git submodule update --init --recursive && \
    sed -i '/openvino~=/d' /openvino_tokenizers/pyproject.toml && \
    sed -i '/requires-python/d' /openvino_tokenizers/pyproject.toml && \
    cd /openvino_tokenizers && cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_VERBOSE_MAKEFILE="${VERBOSE_LOGS}" -DCMAKE_CXX_FLAGS=" ${SDL_OPS} ${LTO_CXX_FLAGS} " -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" -S ./ -B ./build/  && cmake --build ./build/ --parallel $JOBS && cp /openvino_tokenizers/build/src/lib*.so /opt/intel/openvino/runtime/lib/intel64/ && \
    if ! [[ $debug_bazel_flags == *"_py_off"* ]]; then \  
    python3.12 -m pip wheel -v --no-deps --wheel-dir wheel /openvino_tokenizers && \
    python3.12 -m pip install --no-cache-dir "$(find wheel -name 'openvino_tokenizers*.whl')" --target /opt/intel/openvino/python ; \
    fi

WORKDIR /openvino_genai/
ARG ov_genai_branch=master
ARG ov_genai_org=openvinotoolkit
# hadolint ignore=DL3003
RUN if [ "$ov_use_binary" == "0" ]; then true ; else exit 0 ; fi ; \
    git clone https://github.com/$ov_genai_org/openvino.genai /openvino_genai && cd /openvino_genai && git checkout $ov_genai_branch && git submodule update --init --recursive && \
    cmake -DCMAKE_BUILD_TYPE=$CMAKE_BUILD_TYPE -DCMAKE_CXX_FLAGS=" ${SDL_OPS} ${LTO_CXX_FLAGS} " -DCMAKE_SHARED_LINKER_FLAGS="${LTO_LD_FLAGS}" -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DENABLE_SYSTEM_ICU="True" -DBUILD_TOKENIZERS=OFF -DENABLE_SAMPLES=OFF -DENABLE_TOOLS=OFF -DENABLE_TESTS=OFF -DENABLE_XGRAMMAR=ON -S ./ -B ./build/ && \
    cmake --build ./build/ --parallel $JOBS && cp /openvino_genai/build/openvino_genai/lib*.so* /opt/intel/openvino/runtime/lib/intel64/ && \
    cp -r /openvino_genai/src/cpp/include/* /opt/intel/openvino/runtime/include/ && \
    cp /openvino_genai/build/src/cpp/openvino/genai/version.hpp /opt/intel/openvino/runtime/include/openvino/genai/ && \
    if ! [[ $debug_bazel_flags == *"_py_off"* ]]; then \
        cp -r /openvino_genai/build/openvino_genai/*py* /opt/intel/openvino/python/ ; \
    fi

# Build OpenVINO Model Server
WORKDIR /ovms
COPY .bazelrc .user.bazelr[c] .bazelversion WORKSPACE /ovms/
# since bazel does not have easy way to pass if down the dependencies to have select the sources
# for libcurl & ssl we hack it this way
RUN ln -s /usr/lib64 /usr/lib/x86_64-linux-gnu
COPY external /ovms/external/
COPY third_party /ovms/third_party

# This path is required for namespace to setup Python dependencies for testing the binding
COPY src/BUILD /ovms/src/BUILD
COPY src/python/binding/BUILD /ovms/src/python/binding/BUILD
COPY src/python/binding/tests/requirements.txt /ovms/src/python/binding/tests/requirements.txt

WORKDIR /ovms

# hadolint ignore=DL3059

# Mediapipe
COPY BUILD.bazel /ovms/
COPY *\.bzl /ovms/
COPY yarn.lock /ovms/
COPY package.json /ovms/

# prebuild dependencies before copying sources
# hadolint ignore=DL3059
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} //:ovms_dependencies @com_google_googletest//:gtest

# hadolint ignore=DL3059
RUN cp -v /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt

COPY src/ /ovms/src/

# hadolint ignore=DL3059
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} @org_tensorflow//tensorflow/core:framework

# Sample CPU Extension
WORKDIR /ovms/src/example/SampleCpuExtension/
RUN make

RUN if ! [[ $debug_bazel_flags == *"py_off"* ]]; then true ; else exit 0 ; fi ; \
    mkdir -p /opt/intel/openvino/python/openvino-4.dist-info && \
    echo $'Metadata-Version: 1.0\nName: openvino\nVersion: 2026.2' > /opt/intel/openvino/python/openvino-4.dist-info/METADATA
ENV PYTHONPATH=/opt/intel/openvino/python:/ovms/bazel-bin/src/python/binding

WORKDIR /patchelf
# hadolint ignore=DL3003
RUN wget -q https://github.com/NixOS/patchelf/archive/0.10.tar.gz && \
    tar -xf 0.10.tar.gz && cd patchelf-0.10 && \
    ./bootstrap.sh && ./configure && make && make install

WORKDIR /ovms

ARG PROJECT_VERSION="2026.2.0"
LABEL description="OpenVINO Model Server"
ARG minitrace_flags

# Set OVMS version strings
RUN bash -c "sed -i -e 's|REPLACE_PROJECT_VERSION|${PROJECT_VERSION}|g' /ovms/src/version.hpp" && \
    bash -c "sed -i -e 's|REPLACE_BAZEL_BUILD_FLAGS|${debug_bazel_flags}${minitrace_flags}|g' /ovms/src/version.hpp"

# Custom Nodes
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} //src:release_custom_nodes

# OVMS
ARG OPTIMIZE_BUILDING_TESTS=0
RUN rm -f /usr/lib64/cmake/OpenSSL/OpenSSLConfig.cmake

# Builds unit tests together with ovms server in one step
# It speeds up CI when tests are executed outside of the image building
# hadolint ignore=SC2046
RUN bazel build --jobs=$JOBS ${debug_bazel_flags} ${minitrace_flags} //src:ovms $(if [ "$OPTIMIZE_BUILDING_TESTS" == "1" ] ; then echo -n //src:ovms_test; fi)

# Tests execution
COPY ci/check_coverage.bat /ovms/
ARG CHECK_COVERAGE=0
ARG RUN_TESTS=0
COPY run_unit_tests.sh prepare_llm_models.sh prepare_gpu_models.sh demos/common/export_models/export_model.py /ovms/
RUN if [ "$RUN_TESTS" == "1" ] ; then mkdir -p demos/common/export_models/ && mv export_model.py demos/common/export_models/ && ./prepare_llm_models.sh /ovms/src/test/llm_testing docker && ./run_unit_tests.sh ; fi

ARG ovms_metadata_file

RUN /ovms/bazel-bin/src/ovms --version && /ovms/bazel-bin/src/ovms

COPY release_files/thirdparty-licenses/ /ovms/release_files/thirdparty-licenses/
COPY release_files/LICENSE /ovms/release_files/LICENSE
COPY client /client
RUN python3.12 -c "import json; m={'PROJECT_VERSION':'${PROJECT_VERSION}','OPENVINO backend':'$(/ovms/bazel-bin/src/ovms --version | grep 'OpenVINO backend' | cut -d' ' -f3)', \
    'BAZEL_BUILD_FLAGS':'${debug_bazel_flags}${minitrace_flags}}','BASE_IMAGE':'${BASE_IMAGE}' }; \
    print(json.dumps(m,indent=4))" > /ovms/release_files/metadata.json

# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #

FROM $BUILD_IMAGE as capi-build
# C api shared library
ARG CAPI_FLAGS="--strip=always  --config=mp_off_py_off --//:distro=redhat"
ARG JOBS=40
ARG LTO_ENABLE=OFF
WORKDIR /ovms
RUN bazel build --jobs $JOBS ${CAPI_FLAGS} //src:ovms_shared

# C api app with bazel
# hadolint ignore=DL3059
RUN bazel build --jobs $JOBS ${CAPI_FLAGS} //src:capi_cpp_example

# C-API benchmark app
RUN bazel build --jobs=$JOBS ${CAPI_FLAGS} //src:capi_benchmark && ./bazel-bin/src/capi_benchmark --niter 2 --nstreams 1 --servable_name "dummy"
# C-api C/C++ app with gcc
COPY MakefileCapi /ovms/
RUN make -f MakefileCapi cpp CAPI_FLAGS="${CAPI_FLAGS}" && \
    make -f MakefileCapi c CAPI_FLAGS="${CAPI_FLAGS}"

RUN mkdir -p /ovms_release/lib/ ; find /ovms/bazel-out/k8-*/bin -iname 'libovms_shared.so'  -exec cp -v {} /ovms_release/lib/ \;

FROM $BUILD_IMAGE as pkg

COPY --from=build /usr/local/bin/patchelf /usr/local/bin/patchelf

WORKDIR /
ARG BASE_OS=redhat
ARG ov_use_binary=0
ARG FUZZER_BUILD=0
ARG debug_bazel_flags="--strip=always  --config=mp_on_py_on --//:distro=redhat"
COPY --from=capi-build /ovms_release/lib/libovms_shared.so /ovms_release/lib/
COPY create_package.sh /
RUN ./create_package.sh

# hadolint ignore=DL3059
RUN chown -R ovms:ovms /ovms_release
RUN mkdir /licenses && ln -s /ovms_release/LICENSE /licenses && ln -s /ovms_release/thirdparty-licenses /licenses/thirdparty-licenses
# Remove capi library
RUN if [ -f /ovms_release/lib/libovms_shared.so ] ; then mv /ovms_release/lib/libovms_shared.so / ; else exit 0 ; fi ;
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #


FROM $RELEASE_BASE_IMAGE as release
LABEL "name"="OVMS"
LABEL "vendor"="Intel Corporation"
LABEL "version"="2026.2.0"
LABEL "release"="2026"
LABEL "summary"="OpenVINO(TM) Model Server"
LABEL "description"="OpenVINO(TM) Model Server is a solution for serving AI models"
LABEL "maintainer"="dariusz.trawinski@intel.com"
ARG INSTALL_RPMS_FROM_URL=
ARG INSTALL_DRIVER_VERSION="24.52.32224"
ARG GPU=0
ARG debug_bazel_flags=
LABEL bazel-build-flags=${debug_bazel_flags}
LABEL supported-devices="CPU=1 GPU=${GPU}"
ARG RELEASE_BASE_IMAGE
LABEL base-image=${RELEASE_BASE_IMAGE}

ENV PYTHONPATH=/ovms/lib/python:/ovms/python_deps

WORKDIR /
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
COPY ./install_redhat_gpu_drivers.sh /install_gpu_drivers.sh
# hadolint ignore=DL3003,DL3041,SC2164,SC1091
RUN if [ -f /usr/bin/dnf ] ; then export DNF_TOOL=dnf ; echo -e "max_parallel_downloads=8\nretries=50" >> /etc/dnf/dnf.conf ; else export DNF_TOOL=microdnf ; fi ; \
    $DNF_TOOL upgrade --setopt=install_weak_deps=0 --nodocs -y ; \
    if [ "$GPU" == "1" ] ; then \
        source /install_gpu_drivers.sh && rm -rf /install_gpu_drivers.sh; \
    fi ; \
    # For image with Python enabled install Python library
    if ! [[ $debug_bazel_flags == *"py_off"* ]]; then \
        $DNF_TOOL install -y python3.12-libs --setopt=install_weak_deps=0 --nodocs; \
    fi ; \
    $DNF_TOOL install -y shadow-utils; \
    $DNF_TOOL clean all ; \
    cp -v /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt ; \
    groupadd --gid 5000 ovms && groupadd --gid 44 video1 && \
    useradd --home-dir /home/ovms --create-home --uid 5000 --gid 5000 --groups 39,44 --shell /bin/bash --skel /dev/null ovms

ENV LD_LIBRARY_PATH=/ovms/lib
ENV PATH="$PATH:/ovms/bin"

COPY --from=pkg /ovms_release /ovms
COPY --from=pkg /usr/local/lib/python3.12/site-packages/jinja2 /ovms/python_deps/jinja2
COPY --from=pkg /usr/local/lib/python3.12/site-packages/jinja2-3.1.6.dist-info /ovms/python_deps/jinja2-3.1.6.dist-info
COPY --from=pkg /usr/local/lib64/python3.12/site-packages/MarkupSafe-3.0.2.dist-info /ovms/python_deps/MarkupSafe-3.0.2.dist-info
COPY --from=pkg /usr/local/lib64/python3.12/site-packages/markupsafe /ovms/python_deps/markupsafe

COPY --from=pkg /licenses /licenses
USER ovms
ENTRYPOINT ["/ovms/bin/ovms"]