Dockerfile.runner

FROM python:3.13-slim-trixie@sha256:bffeb7bd6a85767587059c6ba23e1e9122078e3aa3fa836099171b9bb5a9bb00 AS python-builder

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    SOURCE_DATE_EPOCH=315532800

WORKDIR /build

COPY LICENSE requirements.build.lock.txt pyproject.toml ./
COPY services/kernel/src ./services/kernel/src

RUN python -m venv /opt/counterlab-build-venv \
    && /opt/counterlab-build-venv/bin/pip install --require-hashes --only-binary=:all: -r requirements.build.lock.txt \
    && /opt/counterlab-build-venv/bin/pip wheel --no-build-isolation --no-deps --wheel-dir /wheelhouse . \
    && sha256sum /wheelhouse/*.whl > /wheelhouse/SHA256SUMS

FROM node:22.23.0-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS node-builder

ENV COREPACK_HOME=/opt/corepack

RUN corepack enable pnpm \
    && corepack prepare pnpm@11.13.1+sha512.b2fc7683b8a6525414e7d13e1ba28caaddde96bf66ec540bfaeb7e702b81f3e0be4d1f295edf7f9fe0396740a8dce4509c582ddf79891f4543fea32d37645f25 --activate

WORKDIR /build

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json vitest.config.ts ./
COPY packages/contracts ./packages/contracts
COPY packages/codex-client ./packages/codex-client
COPY packages/experiment-ir ./packages/experiment-ir
COPY packages/generative-ui-contracts ./packages/generative-ui-contracts
COPY packages/session-core ./packages/session-core
COPY services/hosted-runner ./services/hosted-runner

RUN pnpm install --frozen-lockfile --filter @counterlab/hosted-runner... \
    && node_modules/.pnpm/esbuild@0.28.1/node_modules/esbuild/bin/esbuild \
        services/hosted-runner/src/server.ts \
        --bundle \
        --platform=node \
        --format=esm \
        --target=node22 \
        --outfile=/out/runner.mjs \
    && node --check /out/runner.mjs \
    && mkdir -p /out/codex \
    && cp -a /build/node_modules/.pnpm/@openai+codex@0.144.4-linux-x64/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/. /out/codex/ \
    && mkdir -p \
        /out/runtime-rootfs/dev/pts \
        /out/runtime-rootfs/dev/shm \
        /out/runtime-rootfs/dev/mqueue \
        /out/runtime-rootfs/sys/fs/cgroup \
        /out/runtime-rootfs/counterlab-runtime \
        /out/runtime-rootfs/etc \
    && touch /out/runtime-rootfs/etc/hosts \
    && chmod -R a+rX /out

FROM python:3.13-slim-trixie@sha256:bffeb7bd6a85767587059c6ba23e1e9122078e3aa3fa836099171b9bb5a9bb00

ARG COUNTERLAB_SOURCE_COMMIT=unbound
ARG COUNTERLAB_SOURCE_TREE_SHA256=unbound

LABEL org.opencontainers.image.licenses="MIT" \
    org.opencontainers.image.revision="${COUNTERLAB_SOURCE_COMMIT}" \
    org.opencontainers.image.source="https://github.com/ALikesToCode/CounterLab" \
    io.counterlab.source-tree-sha256="${COUNTERLAB_SOURCE_TREE_SHA256}"

ENV DEBIAN_FRONTEND=noninteractive \
    BLIS_NUM_THREADS=1 \
    MKL_NUM_THREADS=1 \
    NUMEXPR_NUM_THREADS=1 \
    OMP_NUM_THREADS=1 \
    OPENBLAS_NUM_THREADS=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    VECLIB_MAXIMUM_THREADS=1 \
    PATH=/opt/counterlab-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

COPY --from=node-builder /usr/local/bin/node /usr/local/bin/node

RUN apt-get update \
    && apt-get install --yes --no-install-recommends bubblewrap=0.11.0-2+deb13u1 \
    && chmod 0555 /usr/local/bin/node \
    && test -x /usr/local/bin/node \
    && test "$(/usr/bin/bwrap --version)" = "bubblewrap 0.11.0" \
    && test -x /usr/bin/bwrap \
    && test -x /usr/sbin/groupadd \
    && test -x /usr/sbin/useradd \
    && test -x /usr/bin/setpriv \
    && groupadd --gid 10001 counterlab-codex \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin counterlab-codex \
    && python -m venv /opt/counterlab-venv

WORKDIR /app

COPY pyproject.toml requirements.runner.lock.txt ./
COPY fixtures/public/customer_churn.csv ./fixtures/public/customer_churn.csv
COPY fixtures/public/fraud_rare_event.csv ./fixtures/public/fraud_rare_event.csv
COPY --from=python-builder /wheelhouse/ /opt/counterlab-wheelhouse/
COPY --from=node-builder /out/runner.mjs /app/runner.mjs
COPY --from=node-builder /out/codex/ /opt/codex/
COPY --from=node-builder /out/runtime-rootfs/ /

RUN chmod -R a+rX /opt/codex \
    && ln -s /opt/codex/bin/codex /usr/local/bin/codex \
    && /opt/counterlab-venv/bin/pip install --no-cache-dir --require-hashes --only-binary=:all: -r requirements.runner.lock.txt \
    && /opt/counterlab-venv/bin/pip install --no-cache-dir --no-deps --no-index --find-links=/opt/counterlab-wheelhouse counterlab-kernel==0.1.0 \
    && /opt/counterlab-venv/bin/pip check \
    && mkdir -p /work/jobs /run/counterlab-codex \
        /repo/scripts /repo/scientific-engines \
        /repo/fixtures/public /repo/fixtures/notebooks \
    && touch /repo/requirements.runner.lock.txt \
        /repo/reachability-review.json \
        /repo/scripts/verify_scientific_runtime.py \
        /repo/scripts/probe_cpython_htmlparser_reachability.py \
    && chown -R root:root /repo \
    && chmod -R a=rX /repo \
    && chown -R root:root /app \
    && chmod -R a=rX /app \
    && chmod 555 /app/runner.mjs \
    && chown root:root \
        /usr/lib \
        /usr/lib64 \
        /usr/lib/x86_64-linux-gnu \
        /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 \
        /dev/pts \
        /dev/shm \
        /dev/mqueue \
        /sys/fs/cgroup \
        /counterlab-runtime \
    && chmod 0755 \
        /usr/lib \
        /usr/lib64 \
        /usr/lib/x86_64-linux-gnu \
        /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 \
        /dev/pts \
        /dev/shm \
        /dev/mqueue \
        /sys/fs/cgroup \
        /counterlab-runtime \
    && chown -R counterlab-codex:counterlab-codex /work/jobs /run/counterlab-codex \
    && chmod 700 /work/jobs /run/counterlab-codex

USER 10001:10001

EXPOSE 8080

ENTRYPOINT ["/usr/local/bin/node", "/app/runner.mjs"]