Containerfile

# --------------------------------------------------------------------------
# THIS FILE IS AUTOGENERATED - DO NOT EDIT MANUALLY
#
# Source: Containerfile.j2
# --------------------------------------------------------------------------

ARG BASE_VERSION=15.1-latest
ARG UPSTREAM_URL="https://api.github.com/repos/immich-app/immich/releases/latest"

FROM ghcr.io/daemonless/base:${BASE_VERSION} AS builder

ARG UPSTREAM_URL

# Build dependencies
RUN pkg update && pkg install -y \
    jq \
    python312 py312-pip py312-setuptools py312-wheel \
    py312-numpy py312-pillow py312-orjson py312-scipy py312-scikit-learn py312-scikit-image \
    py312-pydantic2 py312-pydantic-settings \
    py312-fastapi py312-uvicorn py312-gunicorn \
    py312-huggingface-hub py312-tokenizers \
    py312-onnx py312-onnxruntime py312-ml-dtypes \
    git-lite gmake pkgconf \
    FreeBSD-clang FreeBSD-clibs-dev FreeBSD-clang-dev FreeBSD-utilities-dev \
    opencv cmake ninja \
    openblas gcc \
    distcc ccache \
    && pkg clean -ay

# Create virtual environment with system packages
RUN python3.12 -m venv --system-site-packages /opt/venv
ENV PATH="/opt/venv/bin:$PATH"
ENV VIRTUAL_ENV="/opt/venv"

# Upgrade pip
RUN pip install --no-cache-dir --upgrade pip setuptools wheel

# Clone immich source (resolve latest version from upstream)
WORKDIR /build
RUN --mount=type=secret,id=github_token \
    GITHUB_TOKEN=$(cat /run/secrets/github_token 2>/dev/null || echo "") && \
    if [ -n "${GITHUB_TOKEN}" ]; then \
      printf 'machine api.github.com login x-access-token password %s\n' "${GITHUB_TOKEN}" > /root/.netrc && \
      chmod 600 /root/.netrc; \
    fi && \
    IMMICH_VERSION=$(fetch -qo - "${UPSTREAM_URL}" | jq -r '.tag_name') && \
    echo "Resolved IMMICH_VERSION=$IMMICH_VERSION" && \
    git clone --depth 1 --branch ${IMMICH_VERSION} \
      https://github.com/immich-app/immich.git . && \
    echo "${IMMICH_VERSION}" > /tmp/immich_version && \
    rm -f /root/.netrc

WORKDIR /build/machine-learning

# latest's py312-albumentations/py312-albucore pkg pairing is mismatched --
# albumentations 2.0.8 calls MAX_VALUES_BY_DTYPE[np.uint32], a key albucore
# 0.2.9 never defines (KeyError at import time, crash-loops at runtime; pkg
# install doesn't catch it since it's not a declared version constraint).
# Use pip instead, so PyPI's own dependency resolution picks a matched pair.
RUN pip install --no-cache-dir --no-deps albumentations albucore && \
    pip install --no-cache-dir \
    aiocache \
    ftfy \
    python-multipart \
    rich

# Install insightface for face recognition
RUN pip install --no-cache-dir --no-deps insightface && \
    pip install --no-cache-dir prettytable easydict cython

# Patch pyproject.toml for FreeBSD compatibility
RUN sed -i '' 's/uvicorn[standard]/uvicorn/g' pyproject.toml && \
    sed -i '' '/opencv-python-headless/d' pyproject.toml

# Install the app
RUN pip install --no-cache-dir --no-deps . && \
    pip install --no-cache-dir --no-deps rapidocr && \
    pip install --no-cache-dir \
    starlette \
    httptools \
    omegaconf \
    colorlog \
    requests \
    pyclipper \
    shapely \
    pyyaml

# https://github.com/immich-app/immich/pull/28610 -- already merged upstream
# as of v3.1.0, so -N makes this a no-op now; kept as a safety net in case a
# future release ever regresses it.
COPY patches/immich-28610-ocr-model_root_dir.patch /tmp/immich-28610.patch
RUN patch -N -d /opt/venv/lib/python3.12/site-packages -p1 < /tmp/immich-28610.patch; \
    rm /tmp/immich-28610.patch; \
    true

# Production image
FROM ghcr.io/daemonless/base:${BASE_VERSION}

ARG FREEBSD_ARCH=amd64
ARG PACKAGES="python312 py312-onnxruntime py312-numpy py312-pillow py312-orjson py312-scipy py312-scikit-learn py312-scikit-image py312-pydantic2 py312-pydantic-settings py312-fastapi py312-uvicorn py312-uvloop py312-gunicorn py312-huggingface-hub py312-tokenizers py312-onnx py312-ml-dtypes openblas geos opencv"
ARG UPSTREAM_URL="https://api.github.com/repos/immich-app/immich/releases/latest"
ARG UPSTREAM_JQ=".tag_name"
ARG HEALTHCHECK_ENDPOINT="http://localhost:3003/ping"

ENV HEALTHCHECK_URL="${HEALTHCHECK_ENDPOINT}"

# --- Metadata (Injected by Generator) ---
LABEL org.opencontainers.image.title="Immich Machine Learning" \
      org.opencontainers.image.description="Machine learning service for Immich — handles facial recognition, image classification, and semantic search using ONNX models." \
      org.opencontainers.image.source="https://github.com/daemonless/immich-ml" \
      org.opencontainers.image.url="https://immich.app/" \
      org.opencontainers.image.version="latest" \
      org.opencontainers.image.licenses="AGPL-3.0" \
      org.opencontainers.image.vendor="daemonless" \
      org.opencontainers.image.authors="daemonless" \
      io.daemonless.category="Photos & Media" \
      io.daemonless.port="3003" \
      io.daemonless.volumes="/cache,/config" \
      io.daemonless.arch="${FREEBSD_ARCH}" \
      io.daemonless.upstream-url="${UPSTREAM_URL}" \
      io.daemonless.upstream-jq="${UPSTREAM_JQ}" \
      io.daemonless.healthcheck-url="${HEALTHCHECK_ENDPOINT}" \
      io.daemonless.packages="${PACKAGES}"

# Install runtime dependencies
RUN pkg update && \
    pkg install -y ${PACKAGES} && \
    pkg clean -ay && \
    rm -rf /var/cache/pkg/* /var/db/pkg/repos/*

# Copy virtual environment from builder (root-owned, world-readable)
COPY --from=builder /opt/venv /opt/venv

# Copy version from builder
COPY --from=builder /tmp/immich_version /tmp/immich_version

# Create directories, write version, and fix permissions
RUN mkdir -p /config /cache /app && \
    cp /tmp/immich_version /app/version && \
    chown bsd:bsd /config /cache && \
    chmod -R a+rX /opt/venv

# Copy service files
COPY root/ /
RUN chmod +x /etc/services.d/*/run /etc/cont-init.d/* 2>/dev/null || true

ENV PATH="/opt/venv/bin:$PATH"
ENV VIRTUAL_ENV="/opt/venv"
ENV MACHINE_LEARNING_HOST=0.0.0.0
ENV MACHINE_LEARNING_PORT=3003
ENV MACHINE_LEARNING_CACHE_FOLDER=/cache
ENV SKIP_CHOWN=true

# --- Expose (Injected by Generator) ---
EXPOSE 3003

# --- Volumes (Injected by Generator) ---
VOLUME /cache /config