# LiteLLM proxy with Stacktrace Guard, for staging. Build from the repository root:
#   docker build -f infra/guard-staging/images/litellm/Dockerfile -t stacktrace-litellm .
FROM python:3.11-slim

# Unprivileged: the proxy needs no root, and the guard reads no host files.
RUN useradd --create-home --uid 10001 app
WORKDIR /app

# The pinned proxy first, in a layer of its own: it changes only with the pin,
# so the deploy's build cache reuses it and only our package reinstalls.
RUN pip install --no-cache-dir 'litellm[proxy]==1.104.2'
COPY pyproject.toml README.md /src/
COPY src /src/src
RUN pip install --no-cache-dir /src && rm -rf /src

COPY integrations/litellm/stacktrace_litellm.py integrations/litellm/stacktrace_keys.py /app/
COPY integrations/litellm/e2e/mock_upstream.py /app/
COPY infra/guard-staging/images/litellm/config.yaml infra/guard-staging/images/litellm/config.subscription.yaml \
     infra/guard-staging/images/litellm/entrypoint.sh /app/

USER app
# No admin UI and no API docs: a key may call the model APIs and nothing else.
ENV PYTHONPATH=/app \
    STACKTRACE_GATEWAY_MODE=observe \
    STACKTRACE_GATEWAY_FINDINGS=- \
    DISABLE_ADMIN_UI=True \
    NO_DOCS=True \
    NO_REDOC=True
EXPOSE 4000
ENTRYPOINT ["/app/entrypoint.sh"]
