Dockerfile

# ── Build stage ───────────────────────────────────────────────────────────────
# Uses the official uv image (includes Python 3.12 + uv).
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim AS builder
WORKDIR /app

# Optional uv extras baked into the gateway venv.  Empty by default keeps the
# production image lean (noop wiring serves every route with zero infra).  Set
# GATEWAY_EXTRAS=backends to pull in rag-backends (asyncpg, etc.) so a
# config-driven serve can use the Postgres corpus store / real backends.
ARG GATEWAY_EXTRAS=""

# Copy workspace manifests first so this layer is cached unless deps change.
COPY pyproject.toml uv.lock ./
COPY packages/core/pyproject.toml packages/core/
COPY packages/config/pyproject.toml packages/config/
COPY apps/gateway/pyproject.toml apps/gateway/

# Install third-party deps without workspace source (maximises cache reuse).
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev --no-install-workspace

# Copy source trees, then install the workspace packages on top.  Every
# workspace member that uv.lock installs must be present — sdks/python is a
# member too, and a full sync fails without it.
COPY packages/ packages/
COPY apps/gateway/ apps/gateway/
COPY sdks/python/ sdks/python/
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev ${GATEWAY_EXTRAS:+--extra ${GATEWAY_EXTRAS}}

# ── Runtime stage ─────────────────────────────────────────────────────────────
FROM python:3.12-slim-bookworm AS runtime
WORKDIR /app

# Workspace members are installed editable, so the venv points back into
# these source trees — copy every member the venv references.
COPY --from=builder /app/.venv /app/.venv
COPY --from=builder /app/packages packages/
COPY --from=builder /app/apps/gateway apps/gateway/
COPY --from=builder /app/sdks/python sdks/python/

ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

EXPOSE 8000

# Serve the gateway via the config-driven entrypoint (v1.0.1): when
# RAG_CONFIG_PATH names a mounted rag.yaml the app is built from it
# (fail-fast on a broken config); unset, the noop-wired app serves every
# route with zero infrastructure.  See docs/reference/gateway.md.
CMD ["uvicorn", "rag_gateway.serve:create_app", "--factory", "--host", "0.0.0.0", "--port", "8000"]