[WIP] Feature/container systemd service

.dockerignore

@@ -0,0 +1,20 @@
+.git
+.github
+.gitattributes
+.gitignore
+.gitlab-ci.yml
+.venv
+.pytest_cache
+.coverage
+**/__pycache__
+**/*.pyc
+**/*.egg-info
+*.log
+docs/
+tests/
+ci/
+Dockerfile
+Dockerfile.dev
+docker-compose*.yml
+/sims
+/upload_folder

.github/workflows/docker_image.yml

@@ -0,0 +1,115 @@
+name: Docker Image build and publish
+
+# Triggers and action summary:
+# pull-request -> ignored in this GHA, linting and testing done elsewhere.
+# push develop -> build and push image tagged :<version> and :develop.
+# push main    -> build and push image tagged :latest.
+# push tag     -> build and push image tagged :<version>.
+
+env:
+  CACHE_FROM: type=gha,scope=simdb-server
+  CACHE_TO: type=gha,mode=max,scope=simdb-server
+  SETUPTOOLS_SCM_OVERRIDES_FOR_IMAS_SIMDB: '{local_scheme = "no-local-version-strict"}'
+
+on:
+  push:
+    branches: [ "develop", "main" ]
+    tags: [ "*" ]
+
+# Serialize runs per ref, so that two merges in quick succession can't race to
+# move the "develop" image tag backward. The running job is never cancelled;
+# GitHub does however keep only the newest *pending* run per group, so a third
+# queued run supersedes the second.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build-and-publish:
+    name: Build and publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+      with:
+        fetch-tags: true
+        fetch-depth: 0
+
+    - name: Get version
+      id: version
+      run: |
+        # A commit between tags describes as "<tag>-<n>-g<sha>", turned into the
+        # PEP 440 version "<tag>.dev<n>+g<sha>"; a commit on a tag describes as
+        # just "<tag>" and is used as is.
+        VERSION=$(git describe --tags --always | sed -r 's/-([0-9]+)-g([0-9a-f]+)$/.dev\1+g\2/')
+        # A Docker tag allows only [A-Za-z0-9_.-], so drop the '+' local segment
+        # for the image tag. That is the version setuptools-scm bakes into the
+        # image (local_scheme = no-local-version-strict), so the tag and
+        # "simdb --version" agree.
+        echo "value=$VERSION" >> "$GITHUB_OUTPUT"
+        echo "tag_value=${VERSION%%+*}" >> "$GITHUB_OUTPUT"
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Build build image
+      uses: docker/build-push-action@v7
+      with:
+        target: build
+        load: true
+        tags: simdb-server:build
+        build-args: APP_VERSION=${{ steps.version.outputs.value }}
+        cache-from: ${{ env.CACHE_FROM }}
+        cache-to: ${{ env.CACHE_TO }}
+
+    - name: Build service image
+      uses: docker/build-push-action@v7
+      with:
+        target: service
+        load: true
+        tags: simdb-server:service
+        build-args: APP_VERSION=${{ steps.version.outputs.value }}
+        cache-from: ${{ env.CACHE_FROM }}
+        cache-to: ${{ env.CACHE_TO }}
+
+    - name: Lowercase repo-owner
+      id: repo_owner
+      run: echo "value=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
+
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v4
+      with:
+        registry: ghcr.io
+        username: ${{ steps.repo_owner.outputs.value }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    # Versioned tag: develop pushes and any tag push. main is excluded -- it
+    # follows develop and only publishes :latest.
+    - name: Tag and push service image with version tag
+      if: ${{ github.ref_type == 'tag' || github.ref_name == 'develop' }}
+      run: |
+        docker tag \
+          simdb-server:service \
+          ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-server:${{ steps.version.outputs.tag_value }}
+        docker push ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-server:${{ steps.version.outputs.tag_value }}
+
+    # Run on develop pushes only
+    - name: Tag image :develop and publish
+      if: ${{ github.ref_type == 'branch' && github.ref_name == 'develop' }}
+      run: |
+        docker tag \
+          simdb-server:service \
+          ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-server:develop
+        docker push ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-server:develop
+
+    # Run on main pushes only
+    - name: Tag image :latest and publish
+      if: ${{ github.ref_type == 'branch' && github.ref_name == 'main' }}
+      run: |
+        docker tag \
+          simdb-server:service \
+          ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-server:latest
+        docker push ghcr.io/${{ steps.repo_owner.outputs.value }}/simdb-server:latest

.gitignore

@@ -11,8 +11,6 @@ environment.yml
 git_update
 runtests
 sdb
-src/simdb/cli/runtests
-src/simdb.egg-info
 test.yml
 test4_manifest.yml
 test7_manifest.yml
@@ -31,3 +29,5 @@ src/simdb/_version.py
 *.egg-info
 *.egg
 *.whl
+/sims
+/upload_folder

Dockerfile

@@ -1,8 +1,10 @@
-ARG PYVER=3.12
-FROM ghcr.io/astral-sh/uv:python${PYVER}-trixie-slim
+# Build stage: Install dependencies and prepare the application
+FROM ghcr.io/astral-sh/uv:0.12.17-python3.12-trixie-slim@sha256:9a59bb7206905ccaae4f7dab222fbac47c125a21e5fc16f43f427cd6c940ade3 \
+    AS build
 
-ENV UV_NO_DEV=1
-ENV SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0
+ENV UV_LINK_MODE=copy \
+    UV_COMPILE_BYTECODE=1 \
+    PYTHONUNBUFFERED=1
 
 WORKDIR /app
 
@@ -14,11 +16,67 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libmagic1 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY uv.lock pyproject.toml alembic.ini ./
+# Install dependencies in their own layer, cached independently.
+COPY uv.lock pyproject.toml ./
+RUN uv sync --locked --no-dev --no-install-project --no-build --extra all
+
+ARG APP_VERSION=0.0.0
+
+# Add the project source and finish the sync.
+ENV SETUPTOOLS_SCM_PRETEND_VERSION_FOR_IMAS_SIMDB="${APP_VERSION}"
+COPY alembic.ini ./
+COPY docker/gunicorn.conf.py ./docker/gunicorn.conf.py
 COPY src/ ./src/
-RUN uv sync --locked --extra all
+RUN uv sync --locked --no-dev --extra all
+
+ENV SIMDB_SITE_CONFIG_PATH=/app/config/simdb.cfg
+
+# Runtime stage: Minimal image with only runtime dependencies
+FROM ghcr.io/astral-sh/uv:0.12.17-python3.12-trixie-slim@sha256:9a59bb7206905ccaae4f7dab222fbac47c125a21e5fc16f43f427cd6c940ade3 \
+    AS service
+
+ARG APP_UID=1000
+ARG APP_GID=1000
+
+ENV UV_LINK_MODE=copy \
+    UV_COMPILE_BYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# Install only runtime dependencies (no build-essential, no *-dev variants, etc.)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq5 \
+    libldap2 \
+    libsasl2-2 \
+    libmagic1 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --gid ${APP_GID} simdb \
+    && useradd --uid ${APP_UID} --gid ${APP_GID} --create-home --shell /usr/sbin/nologin simdb \
+    && mkdir -p /data/simdb/simulations /home/simdb/.gunicorn \
+    && chown -R simdb:simdb /data/simdb /home/simdb /app
+
+# Copy the prepared application and dependencies from build stage
+COPY --from=build --chown=simdb:simdb /app/.venv /app/.venv
+COPY --from=build --chown=simdb:simdb /app/alembic.ini ./
+COPY --from=build --chown=simdb:simdb /app/docker/gunicorn.conf.py ./docker/gunicorn.conf.py
+COPY --from=build --chown=simdb:simdb /app/src/ ./src/
+
+ARG APP_VERSION=0.0.0
+
+LABEL org.opencontainers.image.title="SimDB" \
+      org.opencontainers.image.description="SimDB Server — ITER simulation management tool" \
+      org.opencontainers.image.source="https://github.com/iterorganization/SimDB" \
+      org.opencontainers.image.licenses="LGPL-3.0-only" \
+      org.opencontainers.image.version="${APP_VERSION}" \
+      io.simdb.component="server"
 
 ENV SIMDB_SITE_CONFIG_PATH=/app/config/simdb.cfg
 
-CMD ["uv", "run", "simdb_server"]
+USER simdb
+
+EXPOSE 5000
 
+# Run under Gunicorn rather than the Werkzeug dev server
+CMD ["uv", "run", "gunicorn", "--config=/app/docker/gunicorn.conf.py", "simdb.remote.wsgi:app"]

Dockerfile.dev

@@ -1,6 +1,27 @@
 ARG PYVER=3.12
 FROM ghcr.io/astral-sh/uv:python${PYVER}-trixie-slim
 
+ENV UV_LINK_MODE=copy \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libpq-dev \
+    libldap2-dev \
+    libsasl2-dev \
+    libmagic1 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install dependencies in their own layer, cached independently.
+COPY uv.lock pyproject.toml ./
+RUN uv sync --locked --no-dev --no-install-project --no-build --extra all
+
+# Add the project source and finish the sync.
+ARG APP_VERSION=0.0.0
+ENV SETUPTOOLS_SCM_PRETEND_VERSION_FOR_IMAS_SIMDB="${APP_VERSION}"
+
 ARG SIMDB_GIT_BRANCH=unknown
 ARG SIMDB_GIT_COMMIT=unknown
 ARG SIMDB_DEPLOYMENT=local
@@ -9,26 +30,17 @@ LABEL org.simdb.deployment="${SIMDB_DEPLOYMENT}" \
       org.simdb.git.branch="${SIMDB_GIT_BRANCH}" \
       org.simdb.git.commit="${SIMDB_GIT_COMMIT}"
 
-ENV UV_NO_DEV=1
-ENV SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0
+
 ENV SIMDB_DEPLOYMENT="${SIMDB_DEPLOYMENT}"
 ENV SIMDB_GIT_BRANCH="${SIMDB_GIT_BRANCH}"
 ENV SIMDB_GIT_COMMIT="${SIMDB_GIT_COMMIT}"
 
-WORKDIR /app
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    libpq-dev \
-    libldap2-dev \
-    libsasl2-dev \
-    libmagic1 \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY uv.lock pyproject.toml alembic.ini ./
+COPY alembic.ini ./
 COPY src/ ./src/
-RUN uv sync --locked --extra all
+RUN uv sync --locked --no-dev --extra all
 
 ENV SIMDB_SITE_CONFIG_PATH=/app/config/simdb.cfg
 
+EXPOSE 5000
+
 CMD ["uv", "run", "simdb_server"]