From 9a394427e7e648d06c6a83d6a59ff40c40a1e317 Mon Sep 17 00:00:00 2001 From: Krrish Dholakia Date: Mon, 29 Jun 2026 18:29:50 -0700 Subject: [PATCH] fix(headroom-proxy): use python:3.12 builder with pinned verified rustup, copy site-packages to final stage --- prompt_compression/headroom-proxy/Dockerfile | 22 ++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/prompt_compression/headroom-proxy/Dockerfile b/prompt_compression/headroom-proxy/Dockerfile index e7752e850d1..058417dcdee 100644 --- a/prompt_compression/headroom-proxy/Dockerfile +++ b/prompt_compression/headroom-proxy/Dockerfile @@ -1,19 +1,29 @@ -FROM rust:1.87-slim-bookworm AS builder +FROM python:3.12-slim-bookworm AS builder RUN apt-get update \ - && apt-get install -y --no-install-recommends python3 python3-pip python3-venv build-essential \ + && apt-get install -y --no-install-recommends build-essential curl \ && rm -rf /var/lib/apt/lists/* -RUN python3 -m venv /opt/venv -ENV PATH="/opt/venv/bin:$PATH" +# Download rustup-init and verify its checksum using the official sidecar. +# Pinned to rustup 1.28.1 on x86_64 linux. +RUN curl -Lo /tmp/rustup-init \ + https://static.rust-lang.org/rustup/archive/1.28.1/x86_64-unknown-linux-gnu/rustup-init \ + && curl -Lo /tmp/rustup-init.sha256 \ + https://static.rust-lang.org/rustup/archive/1.28.1/x86_64-unknown-linux-gnu/rustup-init.sha256 \ + && sha256sum --check /tmp/rustup-init.sha256 \ + && chmod +x /tmp/rustup-init \ + && /tmp/rustup-init -y --profile minimal --default-toolchain 1.87.0 --no-modify-path \ + && rm /tmp/rustup-init /tmp/rustup-init.sha256 + +ENV PATH="/root/.cargo/bin:${PATH}" RUN pip install --no-cache-dir "headroom-ai[proxy]==0.27.0" FROM python:3.12-slim-bookworm -COPY --from=builder /opt/venv /opt/venv -ENV PATH="/opt/venv/bin:$PATH" +COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages +COPY --from=builder /usr/local/bin/headroom /usr/local/bin/headroom EXPOSE 8787