Dockerfile

# NeuroSeg inference image.
#
# CPU-only by design: the image is for *serving*, where a single 2-D slice takes
# well under a second on CPU, and a CUDA base image costs several GB for no
# benefit at that workload. Training is expected to run outside the container on
# a GPU host. To build a GPU serving image, swap the base for
# nvidia/cuda:11.8.0-cudnn8-runtime-ubuntu22.04 and install the cu118 torch
# wheels in the same step that installs requirements.
#
# Build:  docker build -t neuroseg:latest .
# Run:    docker run --rm -p 8000:8000 -v "$(pwd)/artifacts:/app/artifacts:ro" neuroseg:latest
# Check:  curl localhost:8000/health

FROM python:3.11-slim AS base

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    NEUROSEG_ARTIFACTS=/app/artifacts

# libglib/libgl are needed by opencv even in headless mode; curl provides the
# container healthcheck below.
RUN apt-get update && apt-get install -y --no-install-recommends \
        libglib2.0-0 \
        libgl1 \
        curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Dependencies are installed before the source is copied so that editing code
# does not invalidate the (slow) dependency layer.
COPY requirements-serving.txt .
RUN pip install --no-cache-dir -r requirements-serving.txt

COPY src/ ./src/
COPY configs/ ./configs/

# Run as a non-root user. The service accepts file uploads, so a container
# escape should not land on root.
RUN useradd --create-home --uid 1000 neuroseg \
    && mkdir -p /app/artifacts \
    && chown -R neuroseg:neuroseg /app
USER neuroseg

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
    CMD curl -fsS http://localhost:8000/health || exit 1

CMD ["uvicorn", "src.serving.app:app", "--host", "0.0.0.0", "--port", "8000"]