refactor: Update README for development and production modes; enhance Dockerfile cleanup and user permissions; adjust pyproject.toml for local dependencies

Author: a-klos

README.md

@@ -225,25 +225,60 @@ cd infrastructure/rag;helm dependency update; cd ../..
 
 After the initial build of the helm chart *Tilt* is able to update the files.
 
+##### Development vs Production Mode
+
+The template supports two deployment modes for local development:
+
+- **Production Mode** (default): Uses production Dockerfiles with local library dependencies for realistic testing
+- **Development Mode**: Uses development Dockerfiles with live code updates for fast iteration
+
 The following will tear up the microservices in *k3d*.
 For the following steps, it is assumed your current working directory is the root of the git-repository.
 
+**Production Mode (default):**
+
 ```shell
 tilt up
 ```
 
+**Development Mode:**
+
+```shell
+tilt up -- --dev=true
+```
+
+##### Docker File Structure
+
+Each service now has separate Docker files optimized for different use cases:
+
+- `Dockerfile`: Production-optimized builds with multi-stage architecture and security hardening
+- `Dockerfile.dev`: Development-optimized builds with faster build times and development tools
+
+The Tilt configuration automatically selects the appropriate Dockerfile based on the mode:
+
+- Production mode uses `Dockerfile` with local library dependencies (`prod-local` group)
+- Development mode uses `Dockerfile.dev` with live code updates and development dependencies
+
 Environment variables are loaded from `.env` file in the root of this git-repository.
 
 The *Tilt* UI is available at [http://localhost:10350/](http://localhost:10350/)
 
 If you want to access *Qdrant* etc. just click the resource in the UI. In the upper corner will be the link, to access the resource.
 
+##### Debugging
+
 To enable debugging, start tilt with the following command:
 
 ```shell
 tilt up -- --debug=true
 ```
 
+It is recommended to combine debugging with development mode:
+
+```shell
+tilt up -- --debug=true --dev=true
+```
+
 The backend will wait until your debugger is connected before it will fully start.
 The debugger used is `debugpy` which is compatible with VS Code.
 To connect the debugger, you can use the following `launch.json`:
@@ -368,10 +403,12 @@ A detailed explanation of, how to access a service via ingress, can be found in
 ### 2.1 Server provisioning
 
 The RAG template requires *at least*:
- - A Kubernetes Cluster
- - S3 ObjectStorage
+
+- A Kubernetes Cluster
+- S3 ObjectStorage
 
 Provided is an example Terraform script, using the [STACKIT Terrraform Provider](https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs):
+
 ```terraform
 resource "stackit_ske_project" "rag-ske" {
   project_id = var.stackit_project_id
@@ -429,8 +466,8 @@ Further requirements for the server can be found in the [infrastructure README](
 
 A detailed description regarding the configuration of Langfuse can be found in the [infrastructure README](./infrastructure/README.md).
 
-
 ## 3. Build and Test
+
 The example `Tiltfile` provides a triggered linting and testing.
 The linting-settings can be changed in the `services/rag-backend/pyproject.toml` file under section `tool.flake8`.
 

services/admin-backend/Dockerfile

@@ -40,6 +40,19 @@ COPY --from=build /usr/local/bin/ /usr/local/bin/
 COPY --from=build /usr/bin/make /usr/bin/make
 COPY --from=build /usr/local/lib/ /usr/local/lib/
 
+# cleanup
+RUN apt-get clean autoclean && apt-get autoremove --yes \
+    && while read -r shell; do rm -f "$shell"; done < /etc/shells || true \
+    && rm -rf /var/lib/{apt,dpkg,cache,log}/ || true
+
+ENV VIRTUAL_ENV="${POETRY_VIRTUALENVS_PATH}"
+ENV PATH="${POETRY_VIRTUALENVS_PATH}/bin:${PATH}"
+
+USER nonroot
+
+COPY --chown=nonroot:nonroot services/admin-backend .
+COPY --from=build --chown=nonroot:nonroot  /app/services/admin-backend/log /app/services/admin-backend/log
+
 # Copy the library source code to the final stage only for local path dependencies
 ARG DEPENDENCY_GROUP=prod
 COPY --from=build --chown=nonroot:nonroot \
@@ -56,18 +69,3 @@ RUN if [ "$DEPENDENCY_GROUP" = "prod-local" ]; then \
         chown -R nonroot:nonroot /app/libs; \
     fi && \
     rm -rf /tmp/conditional-libs
-
-# cleanup
-RUN apt-get clean autoclean && apt-get autoremove --yes \
-    && while read -r shell; do rm -f "$shell"; done < /etc/shells || true \
-    && rm -rf /var/lib/{apt,dpkg,cache,log}/ || true
-
-ENV VIRTUAL_ENV="${POETRY_VIRTUALENVS_PATH}"
-ENV PATH="${POETRY_VIRTUALENVS_PATH}/bin:${PATH}"
-
-USER nonroot
-
-COPY --chown=nonroot:nonroot services/admin-backend .
-COPY --from=build --chown=nonroot:nonroot  /app/services/admin-backend/log /app/services/admin-backend/log
-
-

services/rag-backend/Dockerfile

@@ -44,6 +44,20 @@ COPY --from=build /usr/local/bin/ /usr/local/bin/
 COPY --from=build /usr/bin/make /usr/bin/make
 COPY --from=build /usr/local/lib/ /usr/local/lib/
 
+# cleanup
+RUN apt-get clean autoclean && apt-get autoremove --yes \
+    && while read -r shell; do rm -f "$shell"; done < /etc/shells || true \
+    && rm -rf /var/lib/{apt,dpkg,cache,log}/ || true
+
+ENV VIRTUAL_ENV="${POETRY_VIRTUALENVS_PATH}"
+ENV PATH="${POETRY_VIRTUALENVS_PATH}/bin:${PATH}"
+
+USER nonroot
+
+COPY --chown=nonroot:nonroot services/rag-backend .
+# Preserve log directory from build stage
+COPY --from=build --chown=nonroot:nonroot /app/services/rag-backend/log /app/services/rag-backend/log
+
 # Copy the library source code to the final stage only for local path dependencies
 ARG DEPENDENCY_GROUP=prod
 COPY --from=build --chown=nonroot:nonroot \
@@ -60,17 +74,3 @@ RUN if [ "$DEPENDENCY_GROUP" = "prod-local" ]; then \
         chown -R nonroot:nonroot /app/libs; \
     fi && \
     rm -rf /tmp/conditional-libs
-
-# cleanup
-RUN apt-get clean autoclean && apt-get autoremove --yes \
-    && while read -r shell; do rm -f "$shell"; done < /etc/shells || true \
-    && rm -rf /var/lib/{apt,dpkg,cache,log}/ || true
-
-ENV VIRTUAL_ENV="${POETRY_VIRTUALENVS_PATH}"
-ENV PATH="${POETRY_VIRTUALENVS_PATH}/bin:${PATH}"
-
-USER nonroot
-
-COPY --chown=nonroot:nonroot services/rag-backend .
-# Preserve log directory from build stage
-COPY --from=build --chown=nonroot:nonroot /app/services/rag-backend/log /app/services/rag-backend/log

services/rag-backend/pyproject.toml

@@ -107,6 +107,6 @@ rag-core-api = "==2.2.1"
 rag-core-lib = "==2.2.1"
 
 [tool.poetry.group.prod-local.dependencies]
-# Use local path for Tilt/development with production Dockerfile  
+# Use local path for Tilt/development with production Dockerfile
 rag-core-api = {path = "../../libs/rag-core-api"}
 rag-core-lib = {path = "../../libs/rag-core-lib"}