feat(docker): multi-stage builds for separate development and production environments

.devcontainer/devcontainer.json

@@ -7,16 +7,22 @@
 		"context": "..",
 		// Update the 'dockerFile' property if you aren't using the standard 'Dockerfile' filename.
 		"dockerfile": "../Dockerfile",
-		"args": {
-			"INSTALL_GIT": "true"
-		}
+		"target": "development"
 	},
 
 	// Features to add to the dev container. More info: https://containers.dev/features.
 	// "features": {},
 	"features": {
 		"ghcr.io/devcontainers-extra/features/hatch:2": {}
 	},
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-python.python",
+				"charliermarsh.ruff"
+			]
+		}
+	},
 
 	// Use 'forwardPorts' to make a list of ports inside the container available locally.
 	// "forwardPorts": [],
@@ -28,5 +34,5 @@
 	// "customizations": {},
 
 	// Uncomment to connect as an existing user other than the container default. More info: https://aka.ms/dev-containers-non-root.
-	"remoteUser": "root"
+	// "remoteUser": "root"
 }

.dockerignore

@@ -1 +1,9 @@
-*
+**/coverage
+**/.env
+**/.aws
+**/.ssh
+Dockerfile
+docker-compose.yml
+**/.DS_Store
+**/venv
+**/env

Dockerfile

@@ -1,23 +1,58 @@
-FROM python:3.13-slim-bullseye
+# FFmpeg stage
+FROM jrottenberg/ffmpeg:4.1-scratch AS ffmpeg
 
-USER root
+# Development stage
+FROM python:3.13-bullseye AS development
 
-ARG INSTALL_GIT=false
-RUN if [ "$INSTALL_GIT" = "true" ]; then \
-    apt-get update && apt-get install -y git && rm -rf /var/lib/apt/lists/*; \
-    fi
+COPY --from=ffmpeg / /
 
-# Runtime dependency
+ENV PYTHONUNBUFFERED=1 \
+  PYTHONDONTWRITEBYTECODE=1
+
+# Install build dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ffmpeg \
-    && rm -rf /var/lib/apt/lists/*
+  build-essential \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
 
-RUN pip install markitdown
+RUN pip install --no-cache-dir hatch
 
-# Default USERID and GROUPID
-ARG USERID=10000
-ARG GROUPID=10000
+WORKDIR /app
+COPY . /app/
+
+# Build stage
+FROM python:3.13-bullseye AS build
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  build-essential \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN pip install --no-cache-dir hatch
+
+WORKDIR /app
+
+COPY pyproject.toml /app/
+COPY . /app/
 
-USER $USERID:$GROUPID
+RUN hatch build
+
+# Production stage
+FROM python:3.13-slim-bullseye AS production
+
+# Copy ffmpeg binaries
+COPY --from=ffmpeg / /
+
+WORKDIR /app
+
+COPY --from=build /app/dist /tmp/dist
+
+RUN pip install --no-cache-dir /tmp/dist/markitdown-*.whl
+
+# Default USERID and GROUPID
+RUN adduser -u 5678 --disabled-password --gecos "" appuser && chown -R appuser /app
+USER appuser
 
-ENTRYPOINT [ "markitdown" ]
+# Entrypoint
+ENTRYPOINT ["markitdown"]