["ddtrace-run" "uvicorn" "rag_server.chat_engine_app:app" "--host" "0.0.0.0" "--port" "8000"]

/app

nonroot

RUN /bin/sh -c <<'EOF' bash set -euo pipefail manifest=$(mktemp) tar -xzOf /legal/legal.tar.gz legal/source/packages-manifest.txt > "$manifest" { printf '\n%s\n' "$(printf '=%.0s' {1..80})" echo 'OS Packages Added On Top of Base Image' printf '%s\n\n' "$(printf '=%.0s' {1..80})" echo 'Each package below was installed on top of nvcr.io/nvidia/base/ubuntu by' echo 'this Dockerfile. The verbatim /usr/share/doc/<pkg>/copyright file follows' echo 'each entry. Corresponding Debian source archives are bundled under' echo '/legal/source/ inside /legal/legal.tar.gz.' echo while read -r pkg; do [ -z "$pkg" ] &&
  continue ver=$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null ||
  echo '?') src=$(dpkg-query -W -f='${source:Package}' "$pkg" 2>/dev/null ||
  echo "$pkg") printf '%s\n' "$(printf -- '-%.0s' {1..80})" printf 'Package: %s\nVersion: %s\nSource package: %s\n' "$pkg" "$ver" "$src" printf '%s\n' "$(printf -- '-%.0s' {1..80})" if [ -f "/usr/share/doc/$pkg/copyright" ]; then cat "/usr/share/doc/$pkg/copyright" else echo '(no /usr/share/doc/'"$pkg"'/copyright file present)' fi echo done < "$manifest" } >> /app/THIRD-PARTY.txt rm -f "$manifest" EOF # buildkit

--chown=nonroot:nonroot LICENSE THIRD-PARTY.txt /app/

--chown=nonroot:nonroot /app /app

groupadd --system --gid 999 nonroot &&
  useradd --system --gid 999 --uid 999 --create-home nonroot

RUN /bin/sh -c <<'EOF' bash set -euo pipefail sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources apt list --installed 2>/dev/null | tail -n +2 | sed 's|/.*||' | sort -u > /tmp/before apt-get update apt-get install -y --no-install-recommends curl ca-certificates update-ca-certificates mkdir -p /legal/source && cd /legal/source apt list --installed 2>/dev/null | tail -n +2 | sed 's|/.*||' | sort -u > /tmp/after comm -13 /tmp/before /tmp/after > packages-manifest.txt echo "Downloading sources for $(wc -l < packages-manifest.txt) added package(s)" xargs -n1 -a packages-manifest.txt \
bash -c 'apt-get source --download-only "$0" 2>&1 || echo "Warning: source not available for $0"' \
> download-log.txt 2>&1 cd / tar -czf /legal.tar.gz legal/ rm -rf /legal /var/lib/apt/lists/* /tmp/before /tmp/after mkdir /legal mv /legal.tar.gz /legal/ echo "Legal compliance archive: $(du -sh /legal/legal.tar.gz | cut -f1)" EOF # buildkit

docker/ca-certificates/DigiCertGlobalG2TLSRSASHA2562020CA1.crt /usr/local/share/ca-certificates/DigiCertGlobalG2TLSRSASHA2562020CA1.crt

DEBIAN_FRONTEND=noninteractive PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 LANG=C.UTF-8 TZ=UTC PATH=/app/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin DD_TRACE_HTTP_SERVER_ERROR_STATUSES=500-599 SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt