mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-26 21:53:03 +08:00
94981c443d
- Update builder stage: bookworm-slim → trixie-slim (5 Dockerfiles) - Update runtime stage: python:3.12.13-slim-trixie → python:3.12-slim-trixie - Add pull: true to 6 Docker build steps in nightly workflow - Forces pulling latest base images instead of using cached layers This resolves CVE vulnerabilities in Docker images by ensuring we use the latest Debian Trixie base images instead of cached Bookworm layers.
118 lines
4.5 KiB
Docker
118 lines
4.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
# Keep this syntax directive! It's used to enable Docker BuildKit
|
|
|
|
|
|
################################
|
|
# BUILDER-BASE
|
|
# Used to build deps + create our virtual environment
|
|
################################
|
|
|
|
# 1. use python:3.12.3-slim as the base image until https://github.com/pydantic/pydantic-core/issues/1292 gets resolved
|
|
# 2. do not add --platform=$BUILDPLATFORM because the pydantic binaries must be resolved for the final architecture
|
|
# Use a Python image with uv pre-installed
|
|
FROM ghcr.io/astral-sh/uv:python3.12-trixie-slim AS builder
|
|
|
|
# Install the project into `/app`
|
|
WORKDIR /app
|
|
|
|
# Enable bytecode compilation
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
|
|
# Copy from the cache instead of linking since it's a mounted volume
|
|
ENV UV_LINK_MODE=copy
|
|
|
|
# Set RUSTFLAGS for reqwest unstable features needed by apify-client v2.0.0
|
|
ENV RUSTFLAGS='--cfg reqwest_unstable'
|
|
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get install --no-install-recommends -y \
|
|
# deps for building python deps
|
|
build-essential \
|
|
git \
|
|
# npm
|
|
npm \
|
|
# gcc
|
|
gcc \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy files first to avoid permission issues with bind mounts
|
|
COPY ./uv.lock /app/uv.lock
|
|
COPY ./README.md /app/README.md
|
|
COPY ./pyproject.toml /app/pyproject.toml
|
|
COPY ./src/backend/base/README.md /app/src/backend/base/README.md
|
|
COPY ./src/backend/base/uv.lock /app/src/backend/base/uv.lock
|
|
COPY ./src/backend/base/pyproject.toml /app/src/backend/base/pyproject.toml
|
|
# Copy lfx metadata files since it's a workspace member
|
|
COPY ./src/lfx/pyproject.toml /app/src/lfx/pyproject.toml
|
|
COPY ./src/lfx/README.md /app/src/lfx/README.md
|
|
# Copy sdk metadata files since it's a workspace member
|
|
COPY ./src/sdk/pyproject.toml /app/src/sdk/pyproject.toml
|
|
COPY ./src/sdk/README.md /app/src/sdk/README.md
|
|
|
|
# Install the project's dependencies using the lockfile and settings
|
|
# We need to mount the root uv.lock and pyproject.toml to build the base with uv because we're still using uv workspaces
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
RUSTFLAGS='--cfg reqwest_unstable' \
|
|
cd src/backend/base && uv sync --frozen --no-install-project --no-dev --no-editable --extra postgresql
|
|
|
|
COPY ./src /app/src
|
|
|
|
COPY src/frontend /tmp/src/frontend
|
|
WORKDIR /tmp/src/frontend
|
|
# Increase memory and disable concurrent builds to avoid esbuild crashes on emulated architectures
|
|
# Force esbuild to use JS implementation on emulated architectures to avoid native binary crashes
|
|
RUN npm install \
|
|
&& ESBUILD_BINARY_PATH="" NODE_OPTIONS="--max-old-space-size=4096" JOBS=1 npm run build \
|
|
&& cp -r build /app/src/backend/base/langflow/frontend \
|
|
&& rm -rf /tmp/src/frontend
|
|
|
|
WORKDIR /app/src/backend/base
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
RUSTFLAGS='--cfg reqwest_unstable' \
|
|
uv sync --frozen --no-dev --no-editable --extra postgresql
|
|
|
|
################################
|
|
# RUNTIME
|
|
# Setup user, utilities and copy the virtual environment only
|
|
################################
|
|
FROM python:3.12-slim-trixie AS runtime
|
|
|
|
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get install --no-install-recommends -y curl git libpq5 gnupg xz-utils \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
|
|
COPY --from=builder /usr/local/bin/uvx /usr/local/bin/uvx
|
|
RUN ARCH=$(dpkg --print-architecture) \
|
|
&& if [ "$ARCH" = "amd64" ]; then NODE_ARCH="x64"; \
|
|
elif [ "$ARCH" = "arm64" ]; then NODE_ARCH="arm64"; \
|
|
else NODE_ARCH="$ARCH"; fi \
|
|
&& NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/latest-v22.x/ \
|
|
| sed -nE "s/.*node-v([0-9]+\.[0-9]+\.[0-9]+)-linux-${NODE_ARCH}\.tar\.xz.*/\1/p" \
|
|
| head -1) \
|
|
&& if [ -z "$NODE_VERSION" ]; then echo "ERROR: Could not determine Node.js version" && exit 1; fi \
|
|
&& curl -fsSL "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz" \
|
|
| tar -xJ -C /usr/local --strip-components=1
|
|
RUN useradd user -u 1000 -g 0 --no-create-home --home-dir /app/data
|
|
|
|
COPY --from=builder --chown=1000 /app/.venv /app/.venv
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
|
|
LABEL org.opencontainers.image.title=langflow
|
|
LABEL org.opencontainers.image.authors=['Langflow']
|
|
LABEL org.opencontainers.image.licenses=MIT
|
|
LABEL org.opencontainers.image.url=https://github.com/langflow-ai/langflow
|
|
LABEL org.opencontainers.image.source=https://github.com/langflow-ai/langflow
|
|
|
|
USER user
|
|
WORKDIR /app
|
|
|
|
ENV LANGFLOW_HOST=0.0.0.0
|
|
ENV LANGFLOW_PORT=7860
|
|
|
|
CMD ["langflow-base", "run"]
|