Dockerfile

# SPDX-License-Identifier: BSD-3-Clause

# This environment renders untrusted JavaScript in Chromium, so it builds on the
# Playwright image rather than on openenv-base: the browser, its system
# libraries and its fonts are already there and matched to the Playwright
# version. The same choice is made by envs/browsergym_env for the same reason.
FROM mcr.microsoft.com/playwright/python:v1.62.0-noble

WORKDIR /app/env

# Build context is envs/watercolour_env/, not server/ and not the repo root.
COPY . /app/env

RUN pip install --no-cache-dir uv
RUN uv pip install --system --no-cache .

# The image ships browser builds already; this pins the one Playwright resolves
# at runtime to the same location and makes it readable by a non-root Space user.
ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
RUN python -m playwright install chromium && chmod -R a+rX /ms-playwright

ENV PYTHONUNBUFFERED=1
ENV PYTHONPATH=/app/env

# The reference pool comes from a pinned dataset revision rather than shipping
# inside the image. Fetching it at build time keeps the first `/reset` from paying
# for the download, and HF_HOME is set explicitly because HOME changes below: a
# cache written to the build-time home would not be found at runtime.
ENV HF_HOME=/app/hf-cache
RUN python -c "from server.pool import pool_dir, pool_sources; print(len(list(pool_dir().glob('*.png'))), 'references'); pool_sources()" \
    && chmod -R a+rX /app/hf-cache

# Hugging Face Spaces runs the container as a non-root user, and Chromium wants
# a writable home for its profile and crash dumps.
ENV HOME=/tmp
ENV XDG_CACHE_HOME=/tmp/.cache

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1

CMD ["uvicorn", "watercolour_env.server.app:app", "--host", "0.0.0.0", "--port", "8000"]