5e2094f2ad
FastAPI service in infra/media-worker implementing every MediaInferenceProvider operation behind HTTP API v1, plus capabilities. Bearer auth, MEDIA_ROOT realpath enforcement, strict request schemas, cancellation on disconnect, GPU/CPU gates with 503 overflow, input size/duration limits, lazy SHA256-pinned model downloads, fail-closed redaction with atomic output, offline pytest suite with fake backends, CPU/CUDA/ROCm Dockerfile and a license review of every model. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0138YqDj3ttfayRwuMKKrqVj
69 lines
2.7 KiB
Docker
69 lines
2.7 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# Media Studio inference sidecar.
|
|
# docker build --build-arg ACCELERATOR=cpu|cuda|rocm -t rakazo/media-worker infra/media-worker
|
|
# docker build --target test -t rakazo/media-worker:test infra/media-worker # offline pytest
|
|
# Model weights are not baked in; they download into /models on first use.
|
|
# Behind a TLS-intercepting proxy, pass its CA with --secret id=pip_ca,src=<ca.pem>.
|
|
|
|
ARG ACCELERATOR=cpu
|
|
|
|
FROM python:3.11-slim-bookworm@sha256:2333bd330d12de02514770b3585cad313644316047cdee24a7acfdece6de6efb AS runtime
|
|
ARG ACCELERATOR
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PIP_NO_CACHE_DIR=1 \
|
|
PIP_DISABLE_PIP_VERSION_CHECK=1 \
|
|
TQDM_DISABLE=1 \
|
|
MEDIA_ACCELERATOR=${ACCELERATOR} \
|
|
MEDIA_MODELS_DIR=/models \
|
|
MEDIA_WORKER_PORT=8790
|
|
|
|
RUN case "${ACCELERATOR}" in cpu|cuda|rocm) ;; *) echo "ACCELERATOR must be cpu, cuda or rocm" >&2; exit 1 ;; esac \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends ffmpeg libsndfile1 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /srv/media-worker
|
|
COPY requirements.txt requirements-ml-cpu.txt requirements-ml-cuda.txt requirements-ml-rocm.txt ./
|
|
|
|
# faster-whisper depends on the CPU onnxruntime wheel; the CUDA image swaps in
|
|
# onnxruntime-gpu. SAM2 is an sdist built against the installed torch, without
|
|
# its optional CUDA extension.
|
|
RUN --mount=type=secret,id=pip_ca,required=false \
|
|
if [ -s /run/secrets/pip_ca ]; then export PIP_CERT=/run/secrets/pip_ca; fi \
|
|
&& pip install -r requirements.txt -r "requirements-ml-${ACCELERATOR}.txt" \
|
|
&& if [ "${ACCELERATOR}" = "cuda" ]; then \
|
|
pip uninstall -y onnxruntime && pip install --no-deps --force-reinstall onnxruntime-gpu==1.30.0; \
|
|
fi \
|
|
&& SAM2_BUILD_CUDA=0 pip install --no-build-isolation --no-deps sam2==1.1.0 \
|
|
&& python -c "import cv2, scenedetect, librosa, onnxruntime, faster_whisper, torch, sam2, tokenizers"
|
|
|
|
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin media \
|
|
&& mkdir -p /models \
|
|
&& chown media:media /models
|
|
VOLUME ["/models"]
|
|
|
|
COPY app ./app
|
|
|
|
USER media
|
|
EXPOSE 8790
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD ["python", "-c", "import os, urllib.request; urllib.request.urlopen('http://127.0.0.1:' + os.environ.get('MEDIA_WORKER_PORT', '8790') + '/healthz', timeout=4)"]
|
|
CMD ["python", "-m", "app"]
|
|
|
|
|
|
# Offline test image: same runtime plus pytest; fake backends, no weights.
|
|
FROM runtime AS test
|
|
USER root
|
|
COPY requirements-dev.txt pytest.ini ./
|
|
RUN --mount=type=secret,id=pip_ca,required=false \
|
|
if [ -s /run/secrets/pip_ca ]; then export PIP_CERT=/run/secrets/pip_ca; fi \
|
|
&& pip install -r requirements-dev.txt
|
|
COPY tests ./tests
|
|
USER media
|
|
CMD ["python", "-m", "pytest", "-q"]
|
|
|
|
|
|
FROM runtime
|