# Envoy with Stacktrace Guard, for staging. Build from the repository root:
#   docker build -f infra/guard-staging/images/envoy/Dockerfile -t stacktrace-envoy .
#
# One container, because ECS Express Mode runs one per service: Envoy with the
# Lua filter on 10000, the guard service it calls on loopback 8790, and LiteLLM
# on loopback 9100 with no guardrail, only to speak Bedrock for Envoy. The
# shipped integrations/envoy/envoy.yaml runs unchanged.
FROM envoyproxy/envoy:v1.31.10 AS envoy

FROM python:3.11-slim

RUN useradd --create-home --uid 10001 app
WORKDIR /app

COPY --from=envoy /usr/local/bin/envoy /usr/local/bin/envoy
# The pinned proxy first, in a layer of its own: it changes only with the pin,
# so the deploy's build cache reuses it and only our package reinstalls.
RUN pip install --no-cache-dir 'litellm[proxy]==1.104.2'
COPY pyproject.toml README.md /src/
COPY src /src/src
RUN pip install --no-cache-dir /src && rm -rf /src

COPY integrations/litellm/e2e/mock_upstream.py integrations/litellm/stacktrace_keys.py \
     integrations/litellm/stacktrace_litellm.py \
     integrations/envoy/envoy.yaml /app/
COPY infra/guard-staging/images/envoy/litellm.yaml infra/guard-staging/images/envoy/entrypoint.sh /app/

USER app
# No admin UI and no API docs: a key may call the model APIs and nothing else.
ENV STACKTRACE_GATEWAY_MODE=observe \
    STACKTRACE_GATEWAY_FINDINGS=- \
    DISABLE_ADMIN_UI=True \
    NO_DOCS=True \
    NO_REDOC=True
EXPOSE 10000
ENTRYPOINT ["/app/entrypoint.sh"]
