ardur/Dockerfile.proxy at dev · ArdurAI/ardur · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
ARG PYTHON_IMAGE=python:3.13.14-slim-trixie@sha256:eb43ff125d8d58d7449dcba7d336c23bcac412f526d861db493b9994d8010280

FROM ${PYTHON_IMAGE} AS wheel-builder

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_ROOT_USER_ACTION=ignore
WORKDIR /build
COPY python/ /build/python/
RUN python -m pip wheel \
    --no-cache-dir \
    --no-deps \
    --wheel-dir /wheels \
    /build/python

FROM ${PYTHON_IMAGE}

ARG OCI_VERSION=dev
ARG OCI_REVISION=unknown
ARG OCI_SOURCE=https://github.com/ArdurAI/ardur

LABEL org.opencontainers.image.title="Ardur Governance Proxy" \
      org.opencontainers.image.description="Runtime governance and signed evidence for AI agent tool calls" \
      org.opencontainers.image.source="${OCI_SOURCE}" \
      org.opencontainers.image.revision="${OCI_REVISION}" \
      org.opencontainers.image.version="${OCI_VERSION}" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.vendor="ArdurAI"

ENV HOME=/home/ardur \
    VIBAP_HOME=/home/ardur/.ardur \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_ROOT_USER_ACTION=ignore \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN groupadd --gid 65532 --system ardur && \
    useradd --key UID_MAX=65532 --gid ardur --home-dir /home/ardur --no-create-home \
      --shell /usr/sbin/nologin --uid 65532 ardur

COPY packaging/oci/runtime-requirements.lock /tmp/runtime-requirements.lock
RUN python -m pip install \
      --no-cache-dir \
      --require-hashes \
      --requirement /tmp/runtime-requirements.lock && \
    rm /tmp/runtime-requirements.lock

COPY --from=wheel-builder /wheels/ardur-*.whl /tmp/
RUN python -m pip install --no-cache-dir --no-deps /tmp/ardur-*.whl && \
    python -m pip check && \
    rm /tmp/ardur-*.whl && \
    mkdir -p /home/ardur/.ardur/keys /home/ardur/.ardur/sessions /home/ardur/.ardur/tls && \
    chown -R 65532:65532 /home/ardur

WORKDIR /home/ardur
USER 65532:65532
VOLUME ["/home/ardur/.ardur"]
EXPOSE 8443
STOPSIGNAL SIGTERM

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD ["python3", "-c", "import os,ssl,urllib.request;s='http' if os.environ.get('ARDUR_NO_TLS','').lower() in ('1','true','yes') else 'https';c=ssl.create_default_context();c.check_hostname=False;c.verify_mode=ssl.CERT_NONE;urllib.request.urlopen(f'{s}://localhost:8443/health',context=c,timeout=3)"]

ENTRYPOINT ["ardur", "start", "--host", "0.0.0.0", "--port", "8443", "--keys-dir", "/home/ardur/.ardur/keys", "--state-dir", "/home/ardur/.ardur/sessions", "--log-path", "/home/ardur/.ardur/governance.jsonl"]