terok/Dockerfile at master · terok-ai/terok · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# SPDX-FileCopyrightText: 2026 Jiri Vyskocil
# SPDX-License-Identifier: Apache-2.0
#
# terok-in-Docker — run terok inside a Docker container with nested
# rootless Podman.  Intended for local evaluation only.
#
# Quick start:
#   docker build -t terok-in-docker .
#   docker run -d --privileged --network host --name terok terok-in-docker
#   # open http://localhost:8566
#
# Full documentation: docs/docker.md
#

FROM quay.io/podman/stable

LABEL maintainer="terok maintainers"
LABEL org.opencontainers.image.description="terok with nested rootless Podman — try terok without installing Podman on the host"
LABEL org.opencontainers.image.source="https://github.com/terok-ai/terok"

# ── 1. System packages ──────────────────────────────────────────
RUN dnf install -y \
        python3 \
        python3-pip \
        python3-devel \
        git \
        nftables \
    && dnf clean all

# ── 2. Install terok from local source tree ──────────────────────
# The COPY has no .git, so hatch-vcs resolves the version from
# [tool.hatch.version] fallback-version.
COPY . /opt/terok-src
RUN pip install --break-system-packages /opt/terok-src \
    && rm -rf /opt/terok-src

# ── 3. Prepare terok directories and shell completions ────────────
# Switch to the image's podman user (uid 1000) for all user-space
# setup — directories are created with correct ownership naturally.
USER podman
RUN mkdir -p \
        ~/.config/terok \
        ~/.config/containers \
        ~/.cache/terok \
        ~/.cache/containers \
    && printf '%s\n' \
        'unqualified-search-registries = ["docker.io"]' \
        > ~/.config/containers/registries.conf \
    && terok completions install --shell bash
USER root

# ── 4. Inline entrypoint ──────────────────────────────────────────
# Runs as root (the image default): fixes bind-mount ownership,
# then drops to the podman user via su -m (preserving env vars).
RUN printf '%s\n' '#!/bin/sh' \
        'set -e' \
        'for d in /home/podman/.config/terok /home/podman/.local/share/terok /home/podman/.local/share/containers; do' \
        '    mkdir -p "$d"; chown -R podman:podman "$d"' \
        'done' \
        'if [ $# -gt 0 ]; then exec su -m podman -s /bin/sh -c '"'"'exec "$@"'"'"' sh "$@"; fi' \
        'exec su -m podman -s /bin/sh -c "exec terok-web --host 0.0.0.0 --port 8566 ${TEROK_PUBLIC_URL:+--public-url \"$TEROK_PUBLIC_URL\"}"' \
        > /usr/local/bin/docker-entrypoint.sh \
    && chmod +x /usr/local/bin/docker-entrypoint.sh

WORKDIR /home/podman
EXPOSE 8566

ENV HOME=/home/podman

ENTRYPOINT ["docker-entrypoint.sh"]