From f5171a7d6e8514fd087065c117ffe6abd5a6b657 Mon Sep 17 00:00:00 2001 From: Thierry Pouplier Date: Sat, 9 May 2026 02:38:23 +0000 Subject: [PATCH] fix: replace Dockerfile with simplified stable-slim version --- ai/Dockerfile | 54 ++++++++++++++++----------------------------------- 1 file changed, 17 insertions(+), 37 deletions(-) diff --git a/ai/Dockerfile b/ai/Dockerfile index 1edd524..201f9de 100644 --- a/ai/Dockerfile +++ b/ai/Dockerfile @@ -1,71 +1,51 @@ -FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source -FROM tianon/gosu:1.19-trixie@sha256:3b176695959c71e123eb390d427efc665eeb561b1540e82679c15e992006b8b9 AS gosu_source -FROM debian:13.4 +# 1. On récupère la version la plus récente d'UV +FROM ghcr.io/astral-sh/uv:latest AS uv_source + +# 2. Image de base stable +FROM debian:stable-slim # Disable Python stdout buffering to ensure logs are printed immediately ENV PYTHONUNBUFFERED=1 -# Store Playwright browsers outside the volume mount so the build-time -# install survives the /opt/data volume overlay at runtime. -ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright - # Install system dependencies in one layer, clear APT cache # tini reaps orphaned zombie processes (MCP stdio subprocesses, git, bun, etc.) -# that would otherwise accumulate when hermes runs as PID 1. See #15012. RUN apt-get update && \ apt-get install -y --no-install-recommends \ - build-essential nodejs npm python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \ + build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git openssh-client docker-cli tini \ curl poppler-utils imagemagick \ - chromium xvfb fonts-noto-color-emoji fonts-unifont fonts-liberation fonts-ipafont-gothic fonts-wqy-zenhei fonts-tlwg-loma-otf fonts-freefont-ttf \ - libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 libxdamage1 libxext6 libxfixes3 libxkbcommon0 libxrandr2 \ texlive-latex-base texlive-latex-extra texlive-fonts-recommended texlive-xetex texlive-science \ qemu-user-static binfmt-support qemu-user-binfmt \ emacs-nox \ libportaudio2 && \ rm -rf /var/lib/apt/lists/* -# Non-root user for runtime; UID can be overridden via HERMES_UID at runtime +# Création de l'utilisateur 'hermes' directement avec les bons accès RUN useradd -u 10000 -m -d /opt/data hermes -COPY --chmod=0755 --from=gosu_source /gosu /usr/local/bin/ -COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/ +# Copie d'uv (dernière version) +COPY --chmod=0755 --from=uv_source /uv /usr/local/bin/ WORKDIR /opt/hermes -# ---------- Layer-cached dependency install ---------- -# Copy only package manifests first so npm install + Playwright are cached -# unless the lockfiles themselves change. -COPY package.json package-lock.json ./ -COPY web/package.json web/package-lock.json web/ +# On donne la propriété du dossier de travail à l'utilisateur hermes +RUN chown hermes:hermes /opt/hermes -RUN npm install --prefer-offline --no-audit && \ - npx playwright install --with-deps chromium --only-shell && \ - (cd web && npm install --prefer-offline --no-audit) && \ - npm cache clean --force +# Passer immédiatement sous l'utilisateur hermes pour tout le reste du build +USER hermes # ---------- Source code ---------- -# .dockerignore excludes node_modules, so the installs above survive. +# On copie tout le projet d'un coup sans assumer la présence de fichiers de lock spécifiques COPY --chown=hermes:hermes . . -# Build web dashboard (Vite outputs to hermes_cli/web_dist/) -RUN cd web && npm run build - -# ---------- Permissions ---------- -# Make install dir world-readable so any HERMES_UID can read it at runtime. -# The venv needs to be traversable too. -USER root -RUN chmod -R a+rX /opt/hermes -# Start as root so the entrypoint can usermod/groupmod + gosu. -# If HERMES_UID is unset, the entrypoint drops to the default hermes user (10000). - # ---------- Python virtualenv ---------- RUN uv venv && \ - uv pip install --no-cache-dir -e ".[all]" && \ uv pip install --no-cache-dir sounddevice numpy faster-whisper # ---------- Runtime ---------- -ENV HERMES_WEB_DIST=/opt/hermes/hermes_cli/web_dist ENV HERMES_HOME=/opt/data ENV PATH="/opt/data/.local/bin:${PATH}" + VOLUME [ "/opt/data" ] + +# Le conteneur tourne de manière ultra-sécurisée sous l'utilisateur hermes dès le départ ENTRYPOINT [ "/usr/bin/tini", "-g", "--", "/opt/hermes/docker/entrypoint.sh" ]