QuantStack/Dockerfile at main · kbichave/QuantStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# QuantStack — single-stage production image
# Single-user, local deployment (no multi-tenancy, no auth)

FROM python:3.11-slim-bookworm

LABEL maintainer="QuantStack"
LABEL description="QuantStack trading platform"

# Optional: inject a corporate CA bundle (e.g. Zscaler) for local builds only.
# Usage: docker build --build-arg EXTRA_CA_CERT="$(cat ~/.zscaler_cert.pem)" .
# In CI this arg is empty — no extra certs are added to the production image.
ARG EXTRA_CA_CERT=""
RUN if [ -n "$EXTRA_CA_CERT" ]; then \
        printf '%s\n' "$EXTRA_CA_CERT" >> /usr/local/share/ca-certificates/corporate.crt \
        && update-ca-certificates; \
    fi

# Install system dependencies + TA-Lib C library (required for candlestick patterns)
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    g++ \
    git \
    curl \
    wget \
    make \
    && rm -rf /var/lib/apt/lists/*

# Build TA-Lib from source (not in Debian repos)
RUN wget -q https://github.com/ta-lib/ta-lib/releases/download/v0.6.4/ta-lib-0.6.4-src.tar.gz \
    && tar xzf ta-lib-0.6.4-src.tar.gz \
    && cd ta-lib-0.6.4 \
    && ./configure --prefix=/usr/local \
    && make -j$(nproc) \
    && make install \
    && ldconfig \
    && cd .. \
    && rm -rf ta-lib-0.6.4 ta-lib-0.6.4-src.tar.gz

# Install uv for fast dependency management
RUN pip install --no-cache-dir "uv>=0.5.0"

WORKDIR /app

# ── Layer 1: dependency install (cached unless pyproject.toml/uv.lock change) ──
COPY pyproject.toml uv.lock ./

# ── Layer 2: source code ──
COPY src/ ./src/

# Install all dependencies + editable package in one step.
# BuildKit cache reuses downloaded wheels across rebuilds.
# [langgraph] = graph runtime, [data] = TA-Lib, data providers, [ml] = catboost, xgboost, etc.
RUN --mount=type=cache,target=/root/.cache/uv \
    uv pip install --system -e ".[langgraph,data,ml]"

# Copy scripts (entrypoint, migrations, etc.)
COPY scripts/ ./scripts/

# Create data directories
RUN mkdir -p /data/quantstack

# Create non-root runtime user
RUN useradd -r -m -s /bin/false quantstack
RUN chown -R quantstack:quantstack /app /data

# Set data dir to /data so it can be volume-mounted
ENV KILL_SWITCH_SENTINEL=/data/quantstack/KILL_SWITCH_ACTIVE

# Copy entrypoint
COPY scripts/docker-entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Drop to non-root for all runtime operations
USER quantstack

ENTRYPOINT ["/entrypoint.sh"]
CMD ["api"]