content: ARG VIVARIA_SERVER_DEVICE_TYPE=cpu
  
  ARG AWS_CLI_VERSION=2.27.50
  ARG NODE_VERSION=20.19.5
  ARG UV_VERSION=0.7.20
  
  FROM amazon/aws-cli:${AWS_CLI_VERSION} AS aws-cli
  FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
  
  FROM node:${NODE_VERSION}-slim AS cpu
  
  # Install a version of Apt that works on Ubuntu with FIPS Mode enabled.
  # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014517, fixed in Apt 2.7.2.
  # As of 2024-07-23, Debian testing has Apt 2.9.6.
  RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
      --mount=type=cache,target=/var/lib/apt,sharing=locked \
      echo "deb http://deb.debian.org/debian/ testing main" > /etc/apt/sources.list.d/testing.list \
   && echo "Package: *\nPin: release a=testing\nPin-Priority: 99" > /etc/apt/preferences.d/testing \
   && apt-get update \
   && apt-get install -y -t testing apt
  
  RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
      --mount=type=cache,target=/var/lib/apt,sharing=locked \
      apt-get update \
   && apt-get install -y \
          ca-certificates \
          curl \
          gnupg2 \
          wget
  
  # Add Docker's official GPG key and add the Docker repository to Apt sources
  RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
      --mount=type=cache,target=/var/lib/apt,sharing=locked \
      install -m 0755 -d /etc/apt/keyrings \
   && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
   && chmod a+r /etc/apt/keyrings/docker.asc \
   && echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
    bookworm stable" \
    > /etc/apt/sources.list.d/docker.list \
   && apt-get update \
   && apt-get install -y \
          containerd.io \
          docker-buildx-plugin \
          docker-ce \
          docker-ce-cli \
          docker-compose-plugin
  
  
  # Add Hashicorp's official GPG key and add the Hashicorp repository to Apt sources
  ARG PACKER_PLUGIN_PATH=/opt/packer
  ARG PACKER_GITHUB_API_TOKEN
  RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
      --mount=type=cache,target=/var/lib/apt,sharing=locked \
      wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg \
   && echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com bookworm main" \
    > /etc/apt/sources.list.d/hashicorp.list \
   && export PACKER_GITHUB_API_TOKEN=${PACKER_GITHUB_API_TOKEN} \
   && apt-get update \
   && apt-get install -y \
          packer \
   && mkdir -p ${PACKER_PLUGIN_PATH} \
   && packer plugins install github.com/hashicorp/amazon
  ENV PACKER_PLUGIN_PATH=${PACKER_PLUGIN_PATH}
  
  RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
      --mount=type=cache,target=/var/lib/apt,sharing=locked \
      apt-get update \
   && apt-get install -y \
          git \
          git-lfs \
   && git lfs install
  
  FROM cpu AS gpu
  ARG CUDA_VERSION=12.4
  ARG CUDA_DISTRO=debian12
  RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
      --mount=type=cache,target=/var/lib/apt,sharing=locked \
      CUDA_DISTRO=${CUDA_DISTRO} \
      CUDA_REPO="https://developer.download.nvidia.com/compute/cuda/repos/${CUDA_DISTRO}/x86_64" \
      CUDA_GPG_KEY=/usr/share/keyrings/nvidia-cuda.gpg \
   && wget -O- "${CUDA_REPO}/3bf863cc.pub" | gpg --dearmor > "${CUDA_GPG_KEY}" \
   && echo "deb [signed-by=${CUDA_GPG_KEY} arch=amd64] ${CUDA_REPO}/ /" > /etc/apt/sources.list.d/nvidia-cuda.list \
   && apt-get update -y \
   && apt-get install -yq --no-install-recommends \
          cuda-libraries-${CUDA_VERSION}
  
  ENV LD_LIBRARY_PATH=/usr/local/cuda-${CUDA_VERSION}/lib64
  ENV NVIDIA_VISIBLE_DEVICES=all
  ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility
  
  
  FROM ${VIVARIA_SERVER_DEVICE_TYPE} AS base
  ARG DOCKER_GID=999
  # Ensure docker group has the correct GID, relocating any conflicting groups
  RUN if [ "$(getent group docker | cut -d: -f3)" != "${DOCKER_GID}" ]; then \
      conflicting_group=$(getent group ${DOCKER_GID} | cut -d: -f1 || true); \
      if [ -n "$conflicting_group" ]; then \
          # Find next available GID starting from 60000 (typically unused range) \
          new_gid=60000; \
          while getent group $new_gid >/dev/null 2>&1; do \
              new_gid=$((new_gid + 1)); \
              if [ $new_gid -gt 65535 ]; then \
                  echo "No more GIDs available"; \
                  exit 1; \
              fi; \
          done; \
          groupmod -g $new_gid $conflicting_group; \
      fi; \
      groupmod -g ${DOCKER_GID} docker; \
  fi
  ARG NODE_UID=1000
  RUN [ "$(id -u node)" = "${NODE_UID}" ] || usermod -u "${NODE_UID}" node
  
  ARG PNPM_VERSION=9.11.0
  ARG COREPACK_VERSION=0.31.0
  ENV PNPM_HOME="/pnpm"
  ENV PATH="$PNPM_HOME:$PATH"
  RUN npm install -g corepack@${COREPACK_VERSION} \
   && corepack enable \
   && mkdir -p /app $PNPM_HOME \
   && chown node /app $PNPM_HOME \
   && runuser --login node --command="corepack install --global pnpm@${PNPM_VERSION}"
  
  WORKDIR /app
  COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
  COPY server/package.json ./server/
  COPY shared/package.json ./shared/
  
  
  FROM base AS deps-prod
  RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --prod --frozen-lockfile
  
  FROM base AS deps-inspect-import
  COPY --from=uv /uv /uvx /usr/local/bin/
  ARG PYTHON_VERSION=3.13.5
  ARG UV_PYTHON_INSTALL_DIR=/opt/python
  ENV UV_COMPILE_BYTECODE=1
  ENV UV_LINK_MODE=copy
  ENV UV_NO_INSTALLER_METADATA=1
  RUN uv python install ${PYTHON_VERSION}
  
  WORKDIR /source
  COPY cli/pyproject.toml cli/uv.lock ./
  ARG UV_PROJECT_ENVIRONMENT=/opt/inspect-import
  RUN --mount=type=cache,target=/root/.cache/uv \
      uv sync \
          --locked \
          --no-dev \
          --no-install-project
  
  FROM base AS build
  RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
  
  COPY shared ./shared
  COPY server ./server
  RUN cd server \
   && pnpm run build \
   && pnpm esbuild --bundle --platform=node --outdir=build/migrations src/migrations/*.ts
  
  
  FROM base AS server
  COPY --from=deps-prod /app/node_modules /app/node_modules
  COPY --from=deps-prod /app/server/node_modules /app/server/node_modules
  COPY --from=build /app/server/build /app/server/build
  COPY python-package /app/python-package
  COPY scripts ./scripts
  
  RUN mkdir ignore \
   && chown node ignore
  
  ARG VIVARIA_VERSION=
  ENV VIVARIA_VERSION=${VIVARIA_VERSION}
  
  WORKDIR /app/server
  USER node:docker
  EXPOSE 4001
  ENTRYPOINT [ "node", "--enable-source-maps", "--max-old-space-size=8000", "build/server/server.js" ]
  
  
  FROM server AS inspect-import
  ARG UV_PYTHON_INSTALL_DIR=/opt/python
  COPY --from=deps-inspect-import ${UV_PYTHON_INSTALL_DIR} ${UV_PYTHON_INSTALL_DIR}
  COPY --from=aws-cli /usr/local/aws-cli/v2/current /usr/local
  
  USER root
  ARG UV_PROJECT_ENVIRONMENT=/opt/inspect-import
  COPY --from=deps-inspect-import ${UV_PROJECT_ENVIRONMENT} ${UV_PROJECT_ENVIRONMENT}
  ENV PATH=${UV_PROJECT_ENVIRONMENT}/bin:$PATH
  RUN --mount=from=uv,source=/uv,target=/bin/uv \
      --mount=type=cache,target=/root/.cache/uv \
      --mount=source=cli,target=cli \
      uv sync \
          --directory=cli \
          --locked \
          --no-dev \
          --no-editable
  USER node:docker
  ENTRYPOINT [ "/app/scripts/import-inspect-entry-point.sh" ]
  
  
  FROM base AS run-migrations
  WORKDIR /app/server
  COPY --from=deps-prod /app/node_modules ../node_modules
  COPY --from=deps-prod /app/server/node_modules ./node_modules
  COPY --from=build /app/server/build/migrations ./build/migrations
  COPY server/knexfile.mjs ./
  USER node
  ENTRYPOINT [ "pnpm", "exec", "dotenv", "-e", ".env", "--", "pnpm", "knex" ]
  CMD [ "migrate:latest" ]
  