irene
a1fed2cd71
Multi-stage image built from the `web` extra only, so it carries no Qt: the whole web path (webapp, web_session, metrics_json, and the shared analysis modules) imports no Qt, pyqtgraph or matplotlib canvas. The build stage has the compiler scipy/numba need; the runtime layer installs the built wheel, so the same image works from a checkout or a release tarball. Compose declares no audio volume on purpose. The app keeps no audio, so there is nothing to persist: `read_only` plus a /tmp tmpfs means request spools are memory-backed and never reach a disk. Publishing is loopback-only because the tool has no authentication, and BLAS thread pools are pinned because analysis is CPU-bound. Fix three packaging bugs the build surfaced, each of which broke the image: - `pip install --extra web` is not valid for a source tree; uv wants `.[web]` and failed with "Requesting extras requires a pylock.toml". - The wheel shipped no static assets at all. `package-data` keys match *packages*, and the app modules are top-level `py-modules`, so the `"*"` key matched nothing - verified by inspecting the built wheel: 14 .py files, zero HTML/JS/CSS. An installed `ujm-web` would have 404'd every asset. `static/` is now declared a package (hence its packaging-shim `__init__.py`) so the assets install next to the modules, which is where `webapp.py` looks for them. - The Dockerfile's curated COPY list omitted modules that `py-modules` requires, failing the build with "file <module>.py not found". It copies the checkout, filtered by .dockerignore. Move PyQt5/pyqtgraph into a `desktop` extra so the web install is genuinely Qt-free. Verified: `find` for Qt in a web-only venv now returns nothing, and the desktop path still resolves and imports. Add scripts/make_fixtures.py so the smoke suite has no network or ffmpeg dependency (the tagged MP3 is optional and its assertions skip when absent), and make the suite tolerate that. Verified against the *installed package* running the container's own command line, from a directory with no source tree: 61/61 passing. Also correct README claims that had gone stale: BPM (removed), the matplotlib canvas (replaced by pyqtgraph), and font_control_widget.py (deleted).
89 lines
3.8 KiB
Docker
89 lines
3.8 KiB
Docker
# uj-mastering-master — web UI
|
|
#
|
|
# Multi-stage on purpose: the build stage compiles wheels (librosa pulls in
|
|
# scipy, numba and llvmlite, all of which have C extensions), and none of that
|
|
# toolchain belongs in the runtime image.
|
|
#
|
|
# The runtime image installs the *installed package*, not a source tree, so the
|
|
# same image works whether you built it from a checkout or a release tarball.
|
|
#
|
|
# Note on audio: the web UI stores uploaded audio in the browser (OPFS) and
|
|
# spools each request body to /tmp only for the duration of that request. There
|
|
# is no volume for audio, because the app never keeps any — see README.
|
|
#
|
|
# Note on the desktop app: this image is the *web* front end only. PyQt5 and
|
|
# pyqtgraph are deliberately not installed — there is no display in a container.
|
|
|
|
# ---- build -----------------------------------------------------------------
|
|
FROM python:3.11-slim AS build
|
|
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
UV_LINK_MODE=copy
|
|
|
|
# numba/llvmlite and scipy need a compiler; libsndfile is what soundfile
|
|
# (librosa's decoder) links against at runtime, but the wheel needs it at build
|
|
# time to be detected.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=ghcr.io/astral-sh/uv:0.12.5 /uv /usr/local/bin/uv
|
|
|
|
WORKDIR /src
|
|
# Copy the whole checkout minus .dockerignore. Deliberately not a hand-picked
|
|
# file list: `py-modules` in pyproject.toml enumerates every module the build
|
|
# backend must find, and a curated COPY that omits any of them fails the build
|
|
# with "file <module>.py not found". The exclusions that matter (venv, caches,
|
|
# .git, local state) are in .dockerignore, which is the right place for them.
|
|
COPY . .
|
|
|
|
# Build a wheel, then install it into a self-contained prefix to copy forward.
|
|
# `"uj-mastering-master[web]"` (not `--extra web`) is the syntax uv wants when
|
|
# installing a source tree — `--extra` needs a lockfile/setup.py it does not
|
|
# have here and fails with "Requesting extras requires a pylock.toml...".
|
|
RUN uv venv /opt/venv \
|
|
&& uv pip install --python /opt/venv/bin/python --no-cache \
|
|
".[web]"
|
|
|
|
# ---- runtime ---------------------------------------------------------------
|
|
FROM python:3.11-slim AS runtime
|
|
|
|
# libsndfile1 is the only runtime system dependency: librosa decodes through
|
|
# soundfile, which dlopens it. Everything else is a self-contained wheel.
|
|
# (FFmpeg is *not* needed — it only ever generated test fixtures.)
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libsndfile1 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root, with a home it can actually write to: librosa/numba want a cache
|
|
# dir, and the app spools request bodies under /tmp.
|
|
RUN useradd --create-home --uid 10001 --shell /usr/sbin/nologin ujm
|
|
|
|
COPY --from=build /opt/venv /opt/venv
|
|
|
|
ENV PATH=/opt/venv/bin:$PATH \
|
|
PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
HOME=/home/ujm \
|
|
NUMBA_CACHE_DIR=/tmp/numba-cache \
|
|
MPLCONFIGDIR=/tmp/matplotlib
|
|
|
|
# The app's temporary spools land here. Declared so a read-only root filesystem
|
|
# can still be used (`read_only: true` + `tmpfs: /tmp` in compose).
|
|
VOLUME ["/tmp"]
|
|
|
|
USER ujm
|
|
WORKDIR /home/ujm
|
|
|
|
EXPOSE 8000
|
|
|
|
# Baked-in healthcheck: hit the API rather than the page, so it fails when the
|
|
# *backend* is broken and not merely when a static asset is missing.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/metrics', timeout=4).status == 200 else 1)"]
|
|
|
|
# 0.0.0.0, not the CLI default of 127.0.0.1: loopback inside a container is
|
|
# unreachable from the host, which is the whole point of publishing a port.
|
|
CMD ["ujm-web", "--host", "0.0.0.0", "--port", "8000", "--log-level", "INFO"]
|