# syntax=docker/dockerfile:1.7
# Media Studio inference sidecar.
#   docker build --build-arg ACCELERATOR=cpu|cuda|rocm -t rakazo/media-worker infra/media-worker
#   docker build --target test -t rakazo/media-worker:test infra/media-worker   # offline pytest
# Model weights are not baked in; they download into /models on first use.
# Behind a TLS-intercepting proxy, pass its CA with --secret id=pip_ca,src=<ca.pem>.

ARG ACCELERATOR=cpu

FROM python:3.11-slim-bookworm@sha256:2333bd330d12de02514770b3585cad313644316047cdee24a7acfdece6de6efb AS runtime
ARG ACCELERATOR

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    TQDM_DISABLE=1 \
    MEDIA_ACCELERATOR=${ACCELERATOR} \
    MEDIA_MODELS_DIR=/models \
    MEDIA_WORKER_PORT=8790

RUN case "${ACCELERATOR}" in cpu|cuda|rocm) ;; *) echo "ACCELERATOR must be cpu, cuda or rocm" >&2; exit 1 ;; esac \
 && apt-get update \
 && apt-get install -y --no-install-recommends ffmpeg libsndfile1 \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /srv/media-worker
COPY requirements.txt requirements-ml-cpu.txt requirements-ml-cuda.txt requirements-ml-rocm.txt ./

# faster-whisper depends on the CPU onnxruntime wheel; the CUDA image swaps in
# onnxruntime-gpu. SAM2 is an sdist built against the installed torch, without
# its optional CUDA extension.
RUN --mount=type=secret,id=pip_ca,required=false \
    if [ -s /run/secrets/pip_ca ]; then export PIP_CERT=/run/secrets/pip_ca; fi \
 && pip install -r requirements.txt -r "requirements-ml-${ACCELERATOR}.txt" \
 && if [ "${ACCELERATOR}" = "cuda" ]; then \
      pip uninstall -y onnxruntime && pip install --no-deps --force-reinstall onnxruntime-gpu==1.30.0; \
    fi \
 && SAM2_BUILD_CUDA=0 pip install --no-build-isolation --no-deps sam2==1.1.0 \
 && python -c "import cv2, scenedetect, librosa, onnxruntime, faster_whisper, torch, sam2, tokenizers"

RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin media \
 && mkdir -p /models \
 && chown media:media /models
VOLUME ["/models"]

COPY app ./app

USER media
EXPOSE 8790
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD ["python", "-c", "import os, urllib.request; urllib.request.urlopen('http://127.0.0.1:' + os.environ.get('MEDIA_WORKER_PORT', '8790') + '/healthz', timeout=4)"]
CMD ["python", "-m", "app"]


# Offline test image: same runtime plus pytest; fake backends, no weights.
FROM runtime AS test
USER root
COPY requirements-dev.txt pytest.ini ./
RUN --mount=type=secret,id=pip_ca,required=false \
    if [ -s /run/secrets/pip_ca ]; then export PIP_CERT=/run/secrets/pip_ca; fi \
 && pip install -r requirements-dev.txt
COPY tests ./tests
USER media
CMD ["python", "-m", "pytest", "-q"]


FROM runtime