Dockerfile

# syntax=docker/dockerfile:1
# Keep this syntax directive! It's used to enable Docker BuildKit
# Based on: https://gist.github.com/usr-ein/c42d98abca3cb4632ab0c2c6aff8c88a

##################################################

# Stage 1 - Build Frontend

# Pull base image
FROM node:26-alpine AS frontend-build

# pnpm store location (shared with the BuildKit cache mount below)
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"

# Set work directory
WORKDIR /app/frontend

# Copy manifest, pnpm lockfile and workspace config to Docker environment
COPY ./frontend/package.json ./frontend/pnpm-lock.yaml ./frontend/pnpm-workspace.yaml /app/frontend/

# Install the pnpm version from packageManager and all required node packages
RUN npm install -g "$(node -p "require('./package.json').packageManager")"
RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile

# Copy everything over to Docker environment
COPY ./frontend /app/frontend

# Build the frontend; the Sentry plugin injects the release and, given the
# token, uploads the source maps, which the image then leaves out
ARG VERSION
RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN,env=SENTRY_AUTH_TOKEN \
    pnpm run build && find build -name '*.map' -delete

##################################################

# Stage 2 - Backend base

# Pull base image
FROM python:3.15-alpine AS backend-base

# Set environment variables
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=0 \
    \
    PYSETUP_PATH="/opt/pysetup" \
    VIRTUAL_ENV="/opt/pysetup/.venv"

# Add Venv to Path
ENV PATH="$VIRTUAL_ENV/bin:$PATH"

##################################################

# Stage 3 - Backend builder

# Use backend-base image as base
FROM backend-base AS backend-builder

# Install build dependencies
RUN apk update && apk add postgresql-dev gcc musl-dev python3-dev

# Install uv
COPY --from=ghcr.io/astral-sh/uv:0.13.7 /uv /bin/uv

# Set work directory
WORKDIR $PYSETUP_PATH

# Copy project requirement files here to ensure they will be cached
COPY backend/uv.lock $PYSETUP_PATH
COPY backend/pyproject.toml $PYSETUP_PATH

# Install runtime dependencies
# The --mount will mount the buildx cache directory to where
# uv stores its cache so that it can re-use it
RUN --mount=type=cache,target=/root/.cache \
    uv sync --locked --no-default-groups --group prod

##################################################

# Stage 4 - The Production Environment

# Use backend-base image as base
FROM backend-base AS request-manager-production

# Fixed non-root UID/GID; k8s runAsNonRoot cannot verify a named user.
# High UID so it maps to no host account if the container escapes.
RUN addgroup -S -g 65532 appgroup && adduser -S -u 65532 -G appgroup appuser

# Copy built runtime dependencies from builder container
COPY --from=backend-builder $PYSETUP_PATH $PYSETUP_PATH

# Install runtime dependency for psycopg[c]
RUN apk update && apk add --no-cache libpq

# Copy everything over to Docker environment
COPY ./backend /app/backend

# Copy built frontend assets
RUN mkdir -p /app/frontend/build
COPY --from=frontend-build /app/frontend/build /app/frontend/build-temp

# Have to move all static files other than index.html to root/ for whitenoise middleware
WORKDIR /app/frontend
RUN mkdir build/root && mv build-temp/index.html build/index.html && mv build-temp/static build/static && mv build-temp/* build/root && rm -r build-temp

# Change the owner of all files to the app user
RUN chown -R appuser:appgroup /app

# Change to the app user
LABEL image.uid="65532" image.gid="65532"
USER 65532

# Collect static files
WORKDIR /app/backend
RUN python manage.py collectstatic --no-input --clear --settings=core.settings.base

# Open port
EXPOSE 8000

# Copy and run entrypoint.sh (make sure line endings are UNIX style)
COPY --chown=appuser:appgroup ./docker-entrypoint.sh /app/entrypoint.sh
RUN dos2unix /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh
ENTRYPOINT ["/app/entrypoint.sh"]

# Set health check
HEALTHCHECK --start-period=20s --interval=30s --retries=5 --timeout=30s \
    CMD python manage.py health_check readyz --no-http

# Release reported to Sentry, picked up by sentry_sdk from the environment.
# Set late: it changes every build and invalidates the cache of later layers.
ARG VERSION
ENV SENTRY_RELEASE=${VERSION:+request-manager@$VERSION}

# Start the server
CMD ["gunicorn", "--bind=0.0.0.0:8000", "--workers=5", "--threads=2", "--timeout=60", "--graceful-timeout=30", "core.wsgi"]