mirror of
https://github.com/hanzoai/insights.git
synced 2026-10-30 16:15:31 +00:00
zeekay
4800f1e435
Every web pod on 1.52.84 died here: products/managed_warehouse/backend/metrics.py:6 from hanzo_insights.metrics_capture import InsightsMetrics ModuleNotFoundError: No module named 'hanzo_insights.metrics_capture' The module now exists in hanzo_insights (7.9.8), which records counters, gauges and histograms against /i/v1/metrics — the plane insights/otel_metrics.py already ingests through. Getting it installed took moving the pin. github.com/hanzoai/insights-python is archived: read-only, frozen a commit behind, and nothing can be pushed to it. The url.insteadOf redirect cloud/Dockerfile uses cannot route around that, because uv resolves a github.com git dependency through the GitHub REST API rather than through git — its log says 'Attempting GitHub fast path' — so the build would go on silently resolving the stale commit. The forge is the only address that answers with the code that exists. The forge serves nothing anonymously, so the build gets FORGE_TOKEN as a BuildKit secret, applied through GIT_CONFIG_* in the uv sync command's own environment: never written to /root/.gitconfig, so it cannot survive into a later layer, and never in the pin, so the lockfile keeps naming an address rather than a secret. bin/check-forge-credential asks whether that credential can read the repo in two seconds, before a build spends the hour finding out — the same reason check-imports-are-committed runs at the top of the job.
82 lines
2.8 KiB
Docker
82 lines
2.8 KiB
Docker
# Same as pyproject.toml so that uv can pick it up and doesn't need to download a different Python version.
|
|
FROM python:3.12.12-slim-bookworm AS python-base
|
|
FROM ghcr.io/astral-sh/uv:0.10.2 AS uv
|
|
FROM cruizba/ubuntu-dind:latest
|
|
SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
|
|
|
|
# Copy Python base and uv
|
|
COPY --from=python-base /usr/local /usr/local
|
|
COPY --from=uv /uv /uvx /bin/
|
|
|
|
# Set working directory
|
|
WORKDIR /code
|
|
|
|
# uv settings for Docker builds
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
ENV UV_LINK_MODE=copy
|
|
ENV UV_PROJECT_ENVIRONMENT=/python-runtime
|
|
|
|
# Copy Docker scripts
|
|
COPY docker/ ./docker/
|
|
|
|
# Install system dependencies
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
"build-essential" \
|
|
"git" \
|
|
"libpq-dev" \
|
|
"libxmlsec1" \
|
|
"libxmlsec1-dev" \
|
|
"libffi-dev" \
|
|
"zlib1g-dev" \
|
|
"pkg-config" \
|
|
"netcat-openbsd" \
|
|
"postgresql-client" \
|
|
"cmake" \
|
|
"g++" \
|
|
"uuid-dev" \
|
|
&& \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Build ANTLR4 C++ runtime (required for insightsql-parser)
|
|
RUN curl -L https://www.antlr.org/download/antlr4-cpp-runtime-4.13.1-source.zip -o /tmp/antlr4-source.zip && \
|
|
cd /tmp && unzip antlr4-source.zip -d antlr4-source && cd antlr4-source && \
|
|
cmake . -DCMAKE_INSTALL_PREFIX=/usr -DBUILD_TESTING=OFF -DANTLR4_BUILD_TESTS=OFF && \
|
|
make -j$(nproc) && make install && ldconfig && \
|
|
rm -rf /tmp/antlr4-source /tmp/antlr4-source.zip
|
|
|
|
# Install Python dependencies using cache mount for faster rebuilds
|
|
COPY common/insightsql_parser common/insightsql_parser/
|
|
# FORGE_TOKEN: hanzo-insights resolves from git.hanzo.ai, which answers nothing
|
|
# anonymously. Same mechanism and same reasoning as the main Dockerfile.
|
|
RUN --mount=type=secret,id=FORGE_TOKEN \
|
|
--mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=uv.lock,target=uv.lock \
|
|
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
|
|
set -eu; \
|
|
[ -s /run/secrets/FORGE_TOKEN ] || { \
|
|
echo "FORGE_TOKEN is not mounted. hanzo-insights resolves from git.hanzo.ai, which needs a credential — pass --secret id=FORGE_TOKEN,env=FORGE_TOKEN"; \
|
|
exit 1; \
|
|
}; \
|
|
export GIT_CONFIG_COUNT=1 \
|
|
GIT_CONFIG_KEY_0="url.https://x:$(cat /run/secrets/FORGE_TOKEN)@git.hanzo.ai/.insteadOf" \
|
|
GIT_CONFIG_VALUE_0="https://git.hanzo.ai/"; \
|
|
uv sync --locked --no-install-project --no-binary-package lxml --no-binary-package xmlsec
|
|
|
|
# Copy project files
|
|
COPY bin/ ./bin/
|
|
COPY manage.py manage.py
|
|
COPY common/esbuilder common/esbuilder
|
|
COPY common/scriptvm common/scriptvm/
|
|
COPY insights insights/
|
|
COPY products/ products/
|
|
COPY docker-compose.base.yml docker-compose.dev.yml ./
|
|
|
|
ENV PATH=/python-runtime/bin:$PATH \
|
|
PYTHONPATH=/python-runtime
|
|
|
|
# Make scripts executable
|
|
RUN chmod +x bin/*
|
|
|
|
CMD bin/docker-ai-evals
|