# Container image for running sgnax condor jobs (sgnax-dagger --container).
#
# CI builds and pushes this image to the project registry on every push; see
# docs/user/containers.md for pulling it, converting to a .sif, and pointing
# a DAG at it.
#
# Three stages: export the committed uv.lock as pinned requirements and build
# the sgnax wheel; install both into a plain virtualenv; copy only that venv
# into a slim runtime image. The image is reproducible from the lockfile and
# carries no compilers or package managers. The condor extra (ezdag/htcondor)
# is included so the image can also generate DAGs with sgnax-dagger, not just
# run the jobs. The runtime image also carries a git checkout of this
# repository at /src/sgnax, pinned to the built commit, so a writable sandbox
# can fetch a branch and pip install it without rebuilding the image.

# -- build stage: export locked dependencies and build the wheel ------------- #
FROM ghcr.io/astral-sh/uv:0.11-python3.13-trixie AS build

WORKDIR /app
# git for hatch-vcs to version the wheel from the repo history
RUN apt-get update && apt-get install -y --no-install-recommends git && \
    rm -rf /var/lib/apt/lists/*

COPY . .

RUN uv export --no-editable --no-emit-project --locked --extra condor \
    --format requirements.txt -o requirements.txt
RUN uv build --wheel

# -- install stage: install dependencies + wheel into a virtualenv ----------- #
FROM python:3.13 AS install

WORKDIR /app
COPY --from=build /app/requirements.txt /app
COPY --from=build /app/dist/*.whl /app

RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# The extra index serves the torch +cpu build the lock pins (uv export does
# not emit explicit index URLs into requirements format); every other pin
# resolves from PyPI as usual.
RUN pip install --no-cache-dir \
    --extra-index-url https://download.pytorch.org/whl/cpu \
    -r requirements.txt
RUN pip install --no-cache-dir --no-deps *.whl

# -- final stage: minimal runtime image --------------------------------------#
FROM python:3.13-slim

# git so the /src/sgnax checkout can fetch branches later
RUN apt-get update && apt-get install -y --no-install-recommends git && \
    rm -rf /var/lib/apt/lists/*

COPY --from=install /opt/venv /opt/venv

# full clone of the repository, checked out at the commit the image was built
# from. CI forwards CI_COMMIT_SHA as a build arg (see .gitlab-ci.yml); local
# builds fall back to main.
ARG CI_COMMIT_SHA=main
RUN git clone https://git.ligo.org/detchar/sgn-dq/sgnax.git /src/sgnax && \
    git -C /src/sgnax checkout --quiet "${CI_COMMIT_SHA}"

# /opt/venv/bin matches sgnax's DEFAULT_CONTAINER_BINDIR, which is what
# `sgnax-dagger --container` uses as the in-container executable path.
ENV PATH="/opt/venv/bin:$PATH"

# a shell, not the python REPL the base image defaults to: this is what
# `singularity run` executes, and the interactive workflow (run writable,
# cd /src/sgnax, pip install a branch) needs a shell. Matches the sgnl
# container.
CMD ["/bin/bash"]
