Update Dockerfile

Dockerfile

@@ -1,45 +1,63 @@
-# Stage 1: Build the frontend (Node.js)
-FROM node:21.7.2-bookworm-slim AS frontend-builder
+# ===== MULTI-STAGE DOCKERFILE FOR OPENHANDS WEBAPP =====
+# This Dockerfile builds and runs the complete OpenHands application
+# including both the React frontend and Python FastAPI backend
 
-WORKDIR /app
+# ===== FRONTEND BUILD STAGE =====
+FROM node:22.13.1-bookworm-slim AS frontend-builder
+
+WORKDIR /app/frontend
+
+# Copy package files first for better layer caching
+COPY frontend/package.json frontend/package-lock.json ./
+
+# Install frontend dependencies
+RUN npm ci --only=production
 
-# Copy frontend package files and install dependencies
-COPY ./frontend/package.json ./frontend/package-lock.json ./
-RUN npm install -g npm@10.5.1 && npm ci
+# Copy frontend source code
+COPY frontend/ ./
 
-# Copy frontend source code and build
-COPY ./frontend ./
+# Build the React application
 RUN npm run build
 
-# Stage 2: Build the backend dependencies (Python)
-FROM python:3.12.3-slim AS backend-builder
+# ===== BACKEND BUILD STAGE =====
+FROM python:3.12.8-slim AS backend-builder
 
 WORKDIR /app
-ENV PYTHONPATH='/app'
 
-# Set Poetry environment variables for dependency management
+# Set Poetry environment variables
 ENV POETRY_NO_INTERACTION=1 \
     POETRY_VIRTUALENVS_IN_PROJECT=1 \
     POETRY_VIRTUALENVS_CREATE=1 \
     POETRY_CACHE_DIR=/tmp/poetry_cache
 
-# Install system dependencies and Poetry
-RUN apt-get update -y && \
-    apt-get install -y curl make git build-essential && \
-    python3 -m pip install poetry==1.8.2 --break-system-packages
+# Install system dependencies for building Python packages
+RUN apt-get update -y \
+    && apt-get install -y --no-install-recommends \
+        curl \
+        make \
+        git \
+        build-essential \
+    && rm -rf /var/lib/apt/lists/*
 
-# Copy Poetry files and install dependencies
-COPY ./pyproject.toml ./poetry.lock ./
+# Install Poetry
+RUN python3 -m pip install poetry==1.8.2 --break-system-packages
+
+# Copy Python dependency files first for better layer caching
+COPY pyproject.toml poetry.lock ./
 RUN touch README.md
-RUN poetry install --without evaluation,llama-index --no-root && rm -rf $POETRY_CACHE_DIR
 
-# Stage 3: Final runtime image
-FROM python:3.12.3-slim AS openhands-app
+# Install Python dependencies
+RUN poetry install --no-root --no-dev && rm -rf $POETRY_CACHE_DIR
+
+# ===== FINAL RUNTIME STAGE =====
+FROM python:3.12.8-slim AS runtime
 
 WORKDIR /app
 
-# Define build argument and environment variables
+# Build arguments
 ARG OPENHANDS_BUILD_VERSION=dev
+
+# Environment variables for OpenHands
 ENV RUN_AS_OPENHANDS=true \
     OPENHANDS_USER_ID=42420 \
     SANDBOX_LOCAL_RUNTIME_URL=http://host.docker.internal \
@@ -48,38 +66,75 @@ ENV RUN_AS_OPENHANDS=true \
     OPENHANDS_BUILD_VERSION=$OPENHANDS_BUILD_VERSION \
     SANDBOX_USER_ID=0 \
     FILE_STORE=local \
-    FILE_STORE_PATH=/.openhands-state
+    FILE_STORE_PATH=/.openhands-state \
+    PYTHONPATH='/app' \
+    VIRTUAL_ENV=/app/.venv \
+    PATH="/app/.venv/bin:$PATH"
 
 # Create necessary directories
 RUN mkdir -p $FILE_STORE_PATH $WORKSPACE_BASE
 
-# Install runtime dependencies
-RUN apt-get update -y && \
-    apt-get install -y curl ssh sudo && \
-    apt-get clean
+# Install runtime system dependencies
+RUN apt-get update -y \
+    && apt-get install -y --no-install-recommends \
+        curl \
+        ssh \
+        sudo \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+
+# Configure user management for different UID ranges
+RUN sed -i 's/^UID_MIN.*/UID_MIN 499/' /etc/login.defs \
+    && sed -i 's/^UID_MAX.*/UID_MAX 1000000/' /etc/login.defs
+
+# Create app group and openhands user
+RUN groupadd app \
+    && useradd -l -m -u $OPENHANDS_USER_ID -s /bin/bash openhands \
+    && usermod -aG app openhands \
+    && usermod -aG sudo openhands \
+    && echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+
+# Set ownership and permissions
+RUN chown -R openhands:app /app && chmod -R 770 /app \
+    && chown -R openhands:app $WORKSPACE_BASE && chmod -R 770 $WORKSPACE_BASE
+
+# Switch to openhands user for application setup
+USER openhands
+
+# Copy Python virtual environment from builder stage
+COPY --chown=openhands:app --chmod=770 --from=backend-builder /app/.venv /app/.venv
+
+# Copy Python application code
+COPY --chown=openhands:app --chmod=770 ./microagents ./microagents
+COPY --chown=openhands:app --chmod=770 ./openhands ./openhands
+COPY --chown=openhands:app --chmod=777 ./openhands/runtime/plugins ./openhands/runtime/plugins
+COPY --chown=openhands:app --chmod=770 ./openhands/agenthub ./openhands/agenthub
+
+# Copy configuration and metadata files
+COPY --chown=openhands:app ./pyproject.toml ./poetry.lock ./README.md ./MANIFEST.in ./LICENSE ./
+
+# Download assets (run as openhands user to set correct ownership)
+RUN python openhands/core/download.py
 
-# Adjust UID range in login.defs to avoid conflicts
-RUN sed -i 's/^UID_MIN.*/UID_MIN 499/' /etc/login.defs && \
-    sed -i 's/^UID_MAX.*/UID_MAX 1000000/' /etc/login.defs
+# Copy built frontend from frontend-builder stage
+COPY --chown=openhands:app --chmod=770 --from=frontend-builder /app/frontend/build ./frontend/build
 
-# Create user and group for OpenHands
-RUN groupadd app && \
-    useradd -l -m -u $OPENHANDS_USER_ID -s /bin/bash openhands && \
-    usermod -aG app openhands && \
-    usermod -aG sudo openhands && \
-    echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+# Copy entrypoint script
+COPY --chown=openhands:app --chmod=770 ./containers/app/entrypoint.sh /app/entrypoint.sh
 
-# Copy backend dependencies from backend-builder
-COPY --from=backend-builder /app/.venv ./.venv
+# Ensure all files are in the app group
+RUN find /app \! -group app -exec chgrp app {} + 2>/dev/null || true
 
-# Copy frontend build artifacts from frontend-builder
-COPY --from=frontend-builder /app/dist ./frontend/dist
+# Switch back to root for entrypoint execution
+USER root
 
-# Copy the rest of the application code
-COPY . .
+# Health check to ensure the application is running
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD curl -f http://localhost:3000/ || exit 1
 
-# Expose port for the application
+# Expose the application port
 EXPOSE 3000
 
-# Command to run the application
-CMD ["./.venv/bin/python", "-m", "openhands.server.listen"]
+# Set entrypoint and default command
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["uvicorn", "openhands.server.listen:app", "--host", "0.0.0.0", "--port", "3000"]