# check=skip=FromPlatformFlagConstDisallowed
# implicant demo UI — linux/amd64 (the only Linux wheel target).
# The platform is pinned deliberately: implicant-fhe publishes manylinux
# wheels for x86_64 only, so an arm64 build would fail at pip time. The
# BuildKit lint that discourages a constant --platform is skipped above.
# Windows: Docker Desktop (WSL2) runs this natively.
# macOS users: prefer native `pip install "implicant[ui]"` (amd64 emulation is slow).
FROM --platform=linux/amd64 python:3.13-slim

# Install THIS checkout rather than PyPI. The UI is not published yet, so
# `pip install "implicant[ui]"` resolves to the older release, which has no
# `ui` extra and no `ui` command — the image would build fine and then exit
# immediately on `docker run`. Build from the repo root so the context
# includes src/ and the bundled demo keys (see .dockerignore). The image
# carries the personal-use fanart sprites (owner's direction) — its ghcr
# package therefore stays PRIVATE; registry publishing supersedes spec
# §5.6's out-of-v1 note as of 2026-08-26.
COPY . /src
RUN pip install --no-cache-dir "/src[ui]" && rm -rf /src

EXPOSE 8642
# IMPLICANT_API_URL (optional) points the client at a platform;
# IMPLICANT_API_KEY is passed with `docker run -e`.
# IMPLICANT_UI_PUBLIC_DEMO=1 (optional) serves without the per-launch URL
# token — for the public proxied deployment (demo.implicant.ai) only. Typer
# reads it directly (envvar on --public-demo), so no CMD change is needed;
# it requires IMPLICANT_API_KEY to be set. Default (unset) stays private.
CMD ["sh", "-c", "if [ -n \"$IMPLICANT_API_URL\" ]; then implicant init --api-url \"$IMPLICANT_API_URL\" >/dev/null; else echo \"Warning: IMPLICANT_API_URL is not set. The client falls back to its placeholder default (api.implicant.local), which does not resolve, so every model will fail to load. Re-run with -e IMPLICANT_API_URL=https://your-platform\" >&2; fi; exec implicant ui --host 0.0.0.0 --port 8642 --no-browser"]
