[Badri-Rajendran]

Problem

CLAUDE.md requires a Docker build and image vulnerability scan in CI. docs/decisions/0002-ci-scope.md:31-36 records it as deliberately deferred: "There is no Dockerfile for the app." This adds one, and closes the first of that ADR's two deferred items.

Two properties of this app shape the image more than anything else:

• It carries a model runtime. torch (553 MB of the 1.1 GB venv), sentence-transformers and two models are in the request path.
• It must never carry the documents. data/sbc/ is 983 MB of issuers' PDFs, kept forever and strictly local (ADR 0016, ADR 0019).

Implementation

• Multi-stage, non-root, /app holding only src, migrations and alembic.ini.
• CPU torch on Linux via [[tool.uv.index]] + a sys_platform == 'linux' marker, so macOS development is untouched. Re-locking removed every nvidia-* package and triton.
• Both models baked in at the revisions config.py pins, with HF_HUB_OFFLINE=1 at runtime. No HuggingFace call on a cold start, and an HF outage cannot take the API down.
• CI builds the image, runs it, and fails if /app/data is not empty. A .dockerignore regression is otherwise invisible until an image is gigabytes too large — this is the rule that must not break quietly. Trivy then fails on fixable HIGH/CRITICAL.
• One gunicorn worker, eight threads. Flask-Limiter has no shared storage, so a second worker keeps its own counters and doubles the 5/min register and 10/min login limits. A deliberate ceiling, recorded as one in ADR 0022.
• Production logs JSON to stdout as well as to the file — a container's filesystem is ephemeral and unread. Development is unchanged so an ingestion run's log lines don't interleave with its progress output.

Also here because the image made them matter:

• .env.example, which did not exist although three settings have no default.
• make test / lint / check, so "it passed locally" means what CI means.
• tiktoken and anyio dropped — verified zero imports repo-wide.

Validation — measured, not assumed

Two real defects were found by actually building it:

1. .dockerignore excluded *.md, but pyproject.toml declares readme = "README.md", so hatchling failed: OSError: Readme file does not exist: README.md.
2. uv run re-syncs the default dependency groups, silently pulling ruff, debugpy, jedi and pip back in after --no-dev had removed them. Now the venv's python is invoked directly.

The built image:

size 2.48GB   user policypal   data/: 0 entries
torch 2.14.0+cpu   nvidia packages: 0   ruff: no   pytest: no
models: 217M   gunicorn 26.2.0

The decisive test — a container with no data/ directory, against the live database:

data/ on disk: False
index from Postgres: ['bm25', 'chunk_ids'] 1568 chunks
reranked: 5
  0.999  hcg_glossary_Deductible.md

Served over HTTP it returns the right counties for a ZIP ({"counties":[{"county_fips":"12086","county_name":"Miami-Dade",...), 401 for an unauthenticated /api/auth/me, and access logs on stdout.

• uv run pytest -q — 415 passing. ruff check clean.
• Two new tests pin the logging split: production installs a stdout handler, development does not.

Security / DB / API impact

• Security, positive: non-root user, no dev tooling in the image, no secrets baked in, image scanned on every PR, and CI enforces that no issuer PDF can reach it.
• DB: none.
• API: none. Behaviour is unchanged; only how it is packaged and where it logs.

Note

Stacked on #33 → #32 → #31 → #30 → #29 → #28. CD to Azure is ADR 0002's second deferred item and the next PR.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.