MEGA INFRA
7fd221288a
It read 'dev' on the live site, so it was decoration rather than evidence.
Cause: Coolify does not pass a commit SHA into a Docker Compose build, so my
${BUILD_SHA:-dev} fallback always won.
Read from build.txt in the repo instead, which cannot drift from what is
deployed. Two things that took a try each:
- Docker's ENV does not evaluate $(cat file), so the file is copied into the
image and read at startup.
- Streamlit executes app.py in an exec context where __file__ is not
guaranteed; a bare reference to it inside build_sha() would have taken the
whole app down. It now walks a list of candidate paths and never raises.
Verified: docker build ok; build.txt inside the image reads e1f4127;
build_sha() resolves to e1f4127 in the container; the sidebar renders it.
67 lines
2.4 KiB
Docker
67 lines
2.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# MEGA INFRA · BOQ Converter
|
|
# Streamlit web app. Single process, no database, no build step.
|
|
|
|
FROM python:3.12-slim
|
|
|
|
# libGL/libglib are what pdfplumber -> pdfminer.six -> Wand/OpenCV chain in;
|
|
# without them the container starts and then dies on the first PDF.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
libglib2.0-0 libgl1 curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
WORKDIR /app
|
|
|
|
# Which build is this? Read from a file IN the repo rather than a build arg,
|
|
# because Coolify does not pass a commit SHA into a Docker Compose build - an
|
|
# ARG would silently fall back to "dev" forever and the marker would never
|
|
# tell you anything. Docker's ENV also does not evaluate $(cat ...), so the
|
|
# file is simply copied and the app reads it at startup.
|
|
|
|
# Dependencies first, so a code change does not reinstall the world.
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
COPY app.py run.py ./
|
|
COPY boq_engine/ ./boq_engine/
|
|
COPY static/ ./static/
|
|
COPY .streamlit/ ./.streamlit/
|
|
COPY build.txt ./build.txt
|
|
|
|
# Run as a non-root user. UID 1000 matches the usual Coolify/Docker convention.
|
|
RUN useradd --create-home --uid 1000 --shell /bin/bash megainfra \
|
|
&& mkdir -p /data/profiles /app/out \
|
|
&& chown -R megainfra:megainfra /app /data
|
|
USER megainfra
|
|
|
|
ENV HOME=/home/megainfra \
|
|
BOQ_PROFILES=/data/profiles \
|
|
STREAMLIT_BROWSER_GATHER_USAGE_STATS=false \
|
|
MPLCONFIGDIR=/tmp/mpl
|
|
|
|
EXPOSE 8501
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD curl -fsS http://localhost:8501/_stcore/health || exit 1
|
|
|
|
# Flags here deliberately override .streamlit/config.toml:
|
|
# --server.address 0.0.0.0 the config binds 127.0.0.1 for local dev, which
|
|
# is unreachable from outside the container
|
|
# --server.enableXsrfProtection false
|
|
# Coolify's Traefik sits in front and rewrites the
|
|
# origin; Streamlit's origin check then rejects
|
|
# the rewritten POST as a forged request
|
|
CMD ["streamlit", "run", "app.py", \
|
|
"--server.port=8501", \
|
|
"--server.address=0.0.0.0", \
|
|
"--server.headless=true", \
|
|
"--server.enableCORS=false", \
|
|
"--server.enableXsrfProtection=false", \
|
|
"--browser.gatherUsageStats=false"]
|