# Container image (Linux servers) on Python 3.13, the only version AlphaTown supports. Build from the project root:
#   docker build -f deploy/Dockerfile -t alphatown .
#   docker run -d -p 127.0.0.1:8848:8848 --env-file .env -e ALPHATOWN_HOST=0.0.0.0 -e ALPHATOWN_PORT=8848 \
#     -v alphatown-data:/app/var alphatown
# Dependencies are the pins in constraints.txt (tested on Python 3.13). Inside the container the app must listen on
# 0.0.0.0 (the -e flags win over the .env values): publish the port on 127.0.0.1 as above and in docker-compose.yml, or
# expose it only behind a TLS reverse proxy with APP_ACCESS_TOKEN set. deploy/Dockerfile.dockerignore keeps var/ (your
# data), .env, venvs and internal docs out of the build context (BuildKit, the default builder since Docker 23).
# The agent's python_exec tool is off on Linux (no OS-level isolation for it; strategy backtests are unaffected):
# add -e ALPHATOWN_SANDBOX_PYTHON_EXEC=1 to turn it on.
FROM python:3.13-slim
ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1 PIP_DISABLE_PIP_VERSION_CHECK=1 \
    ALPHATOWN_HOST=0.0.0.0 ALPHATOWN_PORT=8848 TZ=Asia/Shanghai
# Chinese + symbol fonts for the 研报中心 PDF export (the slim image has none); tzdata for TZ / zoneinfo
RUN apt-get update \
 && apt-get install -y --no-install-recommends fonts-wqy-microhei fonts-dejavu-core tzdata \
 && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt constraints.txt ./
RUN pip install --no-cache-dir -r requirements.txt -c constraints.txt
COPY alphatown ./alphatown
COPY web ./web
# docs/: the in-app user manual (帮助 page) and the MCP / data-connector guides the app links to
COPY docs ./docs
COPY LICENSE NOTICE .env.example ./
# run unprivileged; a new named volume on /app/var takes over this ownership
RUN useradd --create-home --uid 10001 alphatown && mkdir -p /app/var && chown alphatown:alphatown /app/var
USER alphatown
EXPOSE 8848
VOLUME ["/app/var"]
CMD ["python", "-m", "alphatown"]
