[docker] Multi-stage Dockerfile

Dockerfile

@@ -1,49 +1,103 @@
-FROM ubuntu:22.04
-
-# Install build tools, ForeFire dependencies, AND Python environment
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-    build-essential \
-    libnetcdf-c++4-dev \
-    cmake \
-    curl \
-    python3 \
-    python3-pip \
-    python3-dev \
-    git && \
-    rm -rf /var/lib/apt/lists/*
-
-# Install Python dependencies for testing
-RUN pip3 install --no-cache-dir lxml xarray netCDF4
+ARG UBUNTU_IMAGE=ubuntu:24.04
 
-WORKDIR /forefire
-ENV FOREFIREHOME=/forefire
+# Stage 1: builder
+FROM ${UBUNTU_IMAGE} AS builder
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+# Keep the BuildKit apt cache mount populated across builds: disable
+# docker-clean's post-install hooks AND tell apt to keep downloaded .debs.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+ && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' \
+        > /etc/apt/apt.conf.d/keep-cache \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends \
+        build-essential \
+        cmake \
+        libnetcdf-c++4-dev \
+        python3-dev \
+        python3-pip
+
+WORKDIR /build
+
+# LICENSE is required by CPack at configure time (CMakeLists includes CPack).
+COPY --link CMakeLists.txt LICENSE ./
+COPY --link app/ ./app/
+# tools/ is needed at configure time: CMakeLists.txt invokes
+# tools/check_all_lfs.bash and references tools/runANN/ANNTest.cpp.
+COPY --link tools/ ./tools/
+COPY --link src/ ./src/
+
+RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
+ && cmake --build build -j"$(nproc)"
+
+COPY --link bindings/ ./bindings/
 
-# Copy build configuration first (rarely changes)
-COPY CMakeLists.txt cmake-build.sh LICENSE ./
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip3 wheel --no-deps --wheel-dir /wheels ./bindings/python
 
-# Copy source code and applications
-COPY src/ ./src/
-COPY app/ ./app/
-COPY tools/runANN/ ./tools/runANN/
 
-# Build and install the ForeFire C++ library
-RUN sh cmake-build.sh
+# Stage 2: runtime
+FROM ${UBUNTU_IMAGE}
 
-# Add the main forefire executable to the PATH
-RUN cp /forefire/bin/forefire /usr/local/bin/
+ARG DEBIAN_FRONTEND=noninteractive
 
-# Use pip to install the Python bindings
-COPY bindings/ ./bindings/
-RUN pip3 install ./bindings/python
+ENV FOREFIREHOME=/forefire \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
 
-# Copy everything else (changes most frequently - docs, tests, etc.)
-COPY . .
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean \
+ && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' \
+        > /etc/apt/apt.conf.d/keep-cache \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends \
+        libnetcdf-c++4-1 \
+        python3 \
+        python3-pip \
+        ca-certificates \
+        curl
 
-# WE COULD USE A CUSTOM ENTRYPOINT SCRIPT TO START THE HTTP SERVER AND RUN THE DEMO SIMULATION
-# COPY tools/devops/entrypoint.sh /usr/local/bin/entrypoint.sh
-# RUN chmod +x /usr/local/bin/entrypoint.sh
-# ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip3 install --break-system-packages \
+        lxml xarray netCDF4
+
+COPY --from=builder --link /build/bin/forefire        /usr/local/bin/forefire
+COPY --from=builder --link /build/lib/libforefireL.so /usr/local/lib/
+COPY --from=builder --link /wheels/                   /tmp/wheels/
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    pip3 install --break-system-packages /tmp/wheels/*.whl \
+ && rm -rf /tmp/wheels \
+ && ldconfig
+
+# Non-root user at UID 1000 so files written to mounted volumes get the
+# host user's ownership. Ubuntu 24.04 ships a default `ubuntu` user at
+# 1000, so we drop it first to free the slot. The /forefire/bin symlink
+# keeps `../../bin/forefire` working in test scripts (tests/runff/ff-run.bash:16).
+RUN userdel --remove ubuntu 2>/dev/null || true \
+ && groupadd --gid 1000 forefire \
+ && useradd  --gid 1000 --uid 1000 --create-home --shell /bin/bash forefire \
+ && mkdir -p /forefire/bin \
+ && ln -s /usr/local/bin/forefire /forefire/bin/forefire \
+ && chown -R 1000:1000 /forefire
+
+COPY --chown=1000:1000 app/      /forefire/app/
+COPY --chown=1000:1000 bindings/ /forefire/bindings/
+COPY --chown=1000:1000 tests/    /forefire/tests/
+COPY --chown=1000:1000 tools/    /forefire/tools/
+
+LABEL org.opencontainers.image.source="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/forefireAPI/forefire" \
+      org.opencontainers.image.documentation="https://forefire.readthedocs.io/" \
+      org.opencontainers.image.description="ForeFire is an open-source code for wildland fire spread models" \
+      org.opencontainers.image.licenses="GPL-3.0-or-later" \
+      org.opencontainers.image.title="forefire"
+
+USER forefire
+WORKDIR /forefire
 
-# Set the entrypoint to bash for interactive sessions
-CMD ["bash"]
+EXPOSE 8000
+CMD ["bash"]