MEGA INFRA
f965e0cc93
The profile store was write-only: the app saved each consultant's detected column map and displayed it, but every run re-detected from scratch. So the original promise - drop their file in and it knows the format - wasn't kept, and worse, the sidebar could show a stale map that didn't match the file in front of you. Now the saved map is applied, with two guards: - it is only used when the columns it names still exist and still make sense for THIS file, so a template that changed shape falls back to detection - 'Re-detect from scratch' in the sidebar overrides it deliberately The hint path runs the same data verification and description-run derivation as the fresh path. Without that a warm run placed 194 lines and a cold one placed 192 - both defensible, but a converter that gives two answers to the same pair of files cannot be trusted on a tender. Cold and warm are now identical on both sample pairs. Also: the build SHA is baked in at image build time and shown in the sidebar, because 'is my deploy current?' is otherwise unanswerable from outside - Streamlit serves a client-rendered shell, so curl cannot see which commit is serving.
66 lines
2.2 KiB
Docker
66 lines
2.2 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# MEGA INFRA · BOQ Converter
|
|
# Streamlit web app. Single process, no database, no build step.
|
|
|
|
FROM python:3.12-slim
|
|
|
|
# libGL/libglib are what pdfplumber -> pdfminer.six -> Wand/OpenCV chain in;
|
|
# without them the container starts and then dies on the first PDF.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
libglib2.0-0 libgl1 curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ENV PYTHONUNBUFFERED=1 \
|
|
PYTHONDONTWRITEBYTECODE=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
WORKDIR /app
|
|
|
|
# Which build is this? Baked in at image build time so "what am I looking at?"
|
|
# is answerable from the page, not by digging through Coolify's log.
|
|
ARG BUILD_SHA=dev
|
|
ENV BOQ_BUILD_SHA=$BUILD_SHA
|
|
|
|
# Dependencies first, so a code change does not reinstall the world.
|
|
COPY requirements.txt .
|
|
RUN pip install --no-cache-dir -r requirements.txt
|
|
|
|
COPY app.py run.py ./
|
|
COPY boq_engine/ ./boq_engine/
|
|
COPY static/ ./static/
|
|
COPY .streamlit/ ./.streamlit/
|
|
|
|
# Run as a non-root user. UID 1000 matches the usual Coolify/Docker convention.
|
|
RUN useradd --create-home --uid 1000 --shell /bin/bash megainfra \
|
|
&& mkdir -p /data/profiles /app/out \
|
|
&& chown -R megainfra:megainfra /app /data
|
|
USER megainfra
|
|
|
|
ENV HOME=/home/megainfra \
|
|
BOQ_PROFILES=/data/profiles \
|
|
STREAMLIT_BROWSER_GATHER_USAGE_STATS=false \
|
|
MPLCONFIGDIR=/tmp/mpl
|
|
BOQ_BUILD_SHA=dev
|
|
|
|
EXPOSE 8501
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD curl -fsS http://localhost:8501/_stcore/health || exit 1
|
|
|
|
# Flags here deliberately override .streamlit/config.toml:
|
|
# --server.address 0.0.0.0 the config binds 127.0.0.1 for local dev, which
|
|
# is unreachable from outside the container
|
|
# --server.enableXsrfProtection false
|
|
# Coolify's Traefik sits in front and rewrites the
|
|
# origin; Streamlit's origin check then rejects
|
|
# the rewritten POST as a forged request
|
|
CMD ["streamlit", "run", "app.py", \
|
|
"--server.port=8501", \
|
|
"--server.address=0.0.0.0", \
|
|
"--server.headless=true", \
|
|
"--server.enableCORS=false", \
|
|
"--server.enableXsrfProtection=false", \
|
|
"--browser.gatherUsageStats=false"]
|