# Envoy with Stacktrace Guard, for staging. Build from the repository root:
#   docker build -f infra/guard-staging/images/envoy/Dockerfile -t stacktrace-envoy .
#
# One container, because ECS Express Mode runs one per service: Envoy with the
# Lua filter on 10000, the guard it calls on loopback 8790 (the enrolled daemon,
# or `stacktrace guard serve` without an enrollment), and LiteLLM on loopback
# 9100 with no guardrail, only to speak Bedrock for Envoy. The shipped
# integrations/envoy/envoy.yaml runs with only its guard token filled in.
FROM envoyproxy/envoy:v1.31.10 AS envoy

FROM python:3.11-slim

RUN useradd --create-home --uid 10001 app
WORKDIR /app

COPY --from=envoy /usr/local/bin/envoy /usr/local/bin/envoy
# The pinned proxy first, in a layer of its own: it changes only with the pin,
# so the deploy's build cache reuses it and only our package reinstalls.
RUN pip install --no-cache-dir 'litellm[proxy]==1.104.2'
COPY pyproject.toml README.md /src/
COPY src /src/src
RUN pip install --no-cache-dir /src && rm -rf /src

COPY integrations/litellm/e2e/mock_upstream.py integrations/litellm/stacktrace_keys.py \
     integrations/litellm/stacktrace_litellm.py \
     integrations/envoy/envoy.yaml /app/
COPY infra/guard-staging/images/envoy/litellm.yaml infra/guard-staging/images/envoy/entrypoint.sh \
     infra/guard-staging/images/daemon.sh /app/

USER app
# No admin UI and no API docs: a key may call the model APIs and nothing else.
ENV STACKTRACE_GATEWAY_MODE=observe \
    STACKTRACE_GATEWAY_FINDINGS=- \
    DISABLE_ADMIN_UI=True \
    NO_DOCS=True \
    NO_REDOC=True
EXPOSE 10000
ENTRYPOINT ["/app/entrypoint.sh"]
