Dockerfile.arm

# This Dockerfile builds OpenMS, the TOPP tools, pyOpenMS and thidparty tools.
# It also adds a basic streamlit server that serves a pyOpenMS-based app.
# hints:
# build image and give it a name (here: streamlitapp) with: docker build -f Dockerfile.arm --no-cache -t streamlitapp:latest-arm64 --build-arg GITHUB_TOKEN=<your-github-token> . 2>&1 | tee build.log
# check if image was build: docker image ls
# run container: docker run -p 8501:8501 streamlitappsimple:latest
# debug container after build (comment out ENTRYPOINT) and run container with interactive /bin/bash shell
# prune unused images/etc. to free disc space (e.g. might be needed on gitpod). Use with care.: docker system prune --all --force

FROM ubuntu:22.04 AS setup-build-system
ARG OPENMS_REPO=https://github.com/OpenMS/OpenMS.git
ARG OPENMS_BRANCH=release/3.5.0
ARG PORT=8501
# Streamlit app GitHub user name (to download artifact from).
ARG GITHUB_USER=OpenMS
# Streamlit app GitHub repository name (to download artifact from).
ARG GITHUB_REPO=streamlit-template

USER root

# Install required Ubuntu packages.
RUN apt-get -y update
RUN apt-get install -y --no-install-recommends --no-install-suggests g++ autoconf automake patch libtool make git gpg wget ca-certificates curl jq libgtk2.0-dev openjdk-8-jdk cron cmake
RUN update-ca-certificates
RUN apt-get install -y --no-install-recommends --no-install-suggests libsvm-dev libeigen3-dev coinor-libcbc-dev libglpk-dev libzip-dev zlib1g-dev libxerces-c-dev libbz2-dev libomp-dev libhdf5-dev
RUN apt-get install -y --no-install-recommends --no-install-suggests libboost-date-time1.74-dev \
                                                                     libboost-iostreams1.74-dev \
                                                                     libboost-regex1.74-dev \
                                                                     libboost-math1.74-dev \
                                                                     libboost-random1.74-dev
RUN apt-get install -y --no-install-recommends --no-install-suggests qt6-base-dev libqt6svg6-dev libqt6opengl6-dev libqt6openglwidgets6 libgl-dev

# Install Github CLI
RUN (type -p wget >/dev/null || (apt-get update && apt-get install wget -y)) \
	&& mkdir -p -m 755 /etc/apt/keyrings \
	&& wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
	&& chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
	&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
	&& apt-get update \
	&& apt-get install gh -y

# Download and install miniforge.
ENV PATH="/root/miniforge3/bin:${PATH}"
RUN wget -q \
    https://github.com/conda-forge/miniforge/releases/latest/download/Miniforge3-Linux-aarch64.sh \
    && bash Miniforge3-Linux-aarch64.sh -b \
    && rm -f Miniforge3-Linux-aarch64.sh
RUN mamba --version

# Make /root traversable so the entrypoint can `source
# /root/miniforge3/bin/activate ...` when the container runs as a non-root
# user (apptainer/singularity maps the host UID into the container; the
# default ubuntu /root is 0700 which would block path traversal). +x only,
# not +r, so the directory listing remains private.
RUN chmod o+x /root

# Setup mamba environment.
RUN mamba create -n streamlit-env python=3.10
RUN echo "mamba activate streamlit-env" >> ~/.bashrc
SHELL ["/bin/bash", "--rcfile", "~/.bashrc"]
SHELL ["mamba", "run", "-n", "streamlit-env", "/bin/bash", "-c"]

# Install up-to-date cmake via mamba and packages for pyOpenMS build.
RUN mamba install cmake
RUN pip install --upgrade pip && python -m pip install -U setuptools nose "cython>=3.1.0,<3.3" "autowrap<=0.24" pandas numpy pytest

# Clone OpenMS branch and the associcated contrib+thirdparties+pyOpenMS-doc submodules.
RUN git clone --recursive --depth=1 -b ${OPENMS_BRANCH} --single-branch ${OPENMS_REPO} && cd /OpenMS

# Pull Linux compatible third-party dependencies and store them in directory thirdparty.
WORKDIR /OpenMS
RUN mkdir /thirdparty && \
    git submodule update --init THIRDPARTY && \
    cp -r THIRDPARTY/All/* /thirdparty && \
    if [ -d "THIRDPARTY/Linux/aarch64" ]; then \
        cp -r THIRDPARTY/Linux/aarch64/* /thirdparty; \
    fi && \
    chmod -R +x /thirdparty
ENV PATH="/thirdparty/LuciPHOr2:/thirdparty/MSGFPlus:/thirdparty/ThermoRawFileParser:/thirdparty/Comet:/thirdparty/Percolator:/thirdparty/Sage:${PATH}"

# Build OpenMS and pyOpenMS.
FROM setup-build-system AS compile-openms
WORKDIR /

# Set up build directory.
RUN mkdir /openms-build
WORKDIR /openms-build

# Configure (two-pass — mirrors FLASHApp.arm).
# Pass 1 runs under plain bash so cmake does NOT search /root/miniforge3
# when resolving C++ system dependencies. On ARM the conda-forge build of
# libyaml-cpp.so.0.8 is linked against a newer libstdc++ (GLIBCXX_3.4.32,
# i.e. gcc 13+) than ubuntu:22.04's system g++ ships, so letting cmake
# pick the miniforge yaml-cpp makes TOPP linking fail with
#   undefined reference to `std::ios_base_library_init()@GLIBCXX_3.4.32`
# amd64 happens to work because its conda-forge yaml-cpp build is older.
# We call the mamba-env cmake by full path so we get a version >= 3.24
# (OpenMS 3.5's floor); ubuntu:22.04's apt cmake is 3.22 which is too old.
# CMAKE_IGNORE_PREFIX_PATH keeps cmake from auto-discovering miniforge libs
# even though the binary itself lives there.
# Pass 2 re-runs cmake inside the mamba env with PYOPENMS=ON so the Python
# bindings can find the conda-forge Python/Cython/NumPy; CMAKE_IGNORE_PREFIX_PATH
# keeps the C++ link command unchanged from pass 1.
SHELL ["/bin/bash", "-c"]
RUN /root/miniforge3/envs/streamlit-env/bin/cmake -DCMAKE_BUILD_TYPE='Release' -DCMAKE_PREFIX_PATH='/OpenMS/contrib-build/;/usr/;/usr/local' -DCMAKE_IGNORE_PREFIX_PATH=/root/miniforge3 -DHAS_XSERVER=OFF -DBOOST_USE_STATIC=OFF ../OpenMS
SHELL ["mamba", "run", "-n", "streamlit-env", "/bin/bash", "-c"]
RUN cmake -DPYOPENMS=ON -DPY_MEMLEAK_DISABLE=On -DCMAKE_IGNORE_PREFIX_PATH=/root/miniforge3 .

# Build TOPP tools and clean up.
RUN make -j4 TOPP
# NOTE: do NOT delete CMakeFiles/ here. The two-pass cmake configure used
# above generates CMakeFiles/VerifyGlobs.cmake for the pyOpenMS targets'
# CONFIGURE_DEPENDS globs; the next `make -j4 pyopenms` runs
# `cmake_check_build_system` which fails fast if VerifyGlobs.cmake is gone:
#   CMake Error: Not a file: /openms-build/CMakeFiles/VerifyGlobs.cmake
# The x86 single-pass build seems to avoid generating that file (different
# cmake codepath when PYOPENMS is set during the initial configure), which
# is why it can still `rm -rf CMakeFiles` here. CMakeFiles/ adds ~a few
# hundred MB to the intermediate layer — acceptable.
RUN rm -rf src doc

# Build pyOpenMS wheels and install via pip.
RUN make -j4 pyopenms
WORKDIR /openms-build/pyOpenMS
RUN pip install dist/*.whl

# Install other dependencies (excluding pyopenms)
COPY requirements.txt ./requirements.txt 
RUN grep -Ev '^pyopenms([=<>!~].*)?$' requirements.txt > requirements_cleaned.txt && mv requirements_cleaned.txt requirements.txt
RUN pip install -r requirements.txt

WORKDIR /
RUN mkdir openms

# Copy TOPP tools bin directory, add to PATH.
RUN cp -r openms-build/bin /openms/bin
ENV PATH="/openms/bin/:${PATH}"

# Copy TOPP tools bin directory, add to PATH.
RUN cp -r openms-build/lib /openms/lib
ENV LD_LIBRARY_PATH="/openms/lib/:${LD_LIBRARY_PATH}"

# Copy share folder, add to PATH, remove source directory.
RUN cp -r OpenMS/share/OpenMS /openms/share
RUN rm -rf OpenMS
ENV OPENMS_DATA_PATH="/openms/share/"

# Remove build directory.
RUN rm -rf openms-build

# Prepare and run streamlit app.
FROM compile-openms AS run-app

# Install Redis server for job queue and nginx for load balancing.
# Redis data lives under $RUNTIME_DIR at runtime (see entrypoint.sh) so no
# /var/lib/redis setup is needed - that path is not writable under Apptainer.
RUN apt-get update && apt-get install -y --no-install-recommends redis-server nginx \
    && rm -rf /var/lib/apt/lists/*

# Create Redis data directory. Default 0755 root-owned is enough: the docker
# entrypoint runs as root (can write regardless of mode), and the apptainer
# entrypoint relocates Redis state to /tmp/openms-runtime-* so this dir is
# never written under apptainer.
RUN mkdir -p /var/lib/redis

# Pre-create bind-mount targets so apptainer/singularity has a real attach
# point. Docker auto-creates missing `-v` targets, but singularity uses a
# read-only underlay and silently ignores `:rw` when the target isn't a
# real directory in the SIF — writes then fail with EROFS even though the
# host bind path is writable. Pre-creating these directories costs one
# inode each and changes nothing in docker mode (the user's volume mount
# shadows them).
RUN mkdir -p /workspaces-streamlit-template /mounted-data

# Create workdir and copy over all streamlit related files/folders.

# note: specifying folder with slash as suffix and repeating the folder name seems important to preserve directory structure
WORKDIR /app
COPY assets/ /app/assets
COPY content/ /app/content
COPY docs/ /app/docs
COPY example-data/ /app/example-data
COPY gdpr_consent/ /app/gdpr_consent
COPY hooks/ /app/hooks
COPY src/ /app/src
COPY utils/ /app/utils
COPY app.py /app/app.py
COPY settings.json /app/settings.json
COPY default-parameters.json /app/default-parameters.json
COPY presets.json /app/presets.json

# For streamlit configuration
COPY .streamlit/ /app/.streamlit/
COPY clean-up-workspaces.py /app/clean-up-workspaces.py

# add cron job to the crontab
RUN echo "0 3 * * * /root/miniforge3/envs/streamlit-env/bin/python /app/clean-up-workspaces.py >> /app/clean-up-workspaces.log 2>&1" | crontab -

# Set default worker count (can be overridden via environment variable)
ENV RQ_WORKER_COUNT=1
ENV REDIS_URL=redis://localhost:6379/0

# Number of Streamlit server instances for load balancing (default: 1 = no load balancer)
# Set to >1 to enable nginx load balancer with multiple Streamlit instances
ENV STREAMLIT_SERVER_COUNT=1

# Install the apptainer-compatible entrypoint that starts cron (when the root
# FS is writable), Redis, RQ workers, optional nginx load balancer, and the
# Streamlit server. The script falls back to /tmp paths under apptainer.
COPY docker/entrypoint.sh /app/entrypoint.sh
RUN chmod +x /app/entrypoint.sh

# Install the demo-seeding script run by the seed-demos initContainer
# (k8s/base/streamlit-deployment.yaml). One copy of the logic, so what the
# image ships is what tests/test_seed_demos.py executes.
COPY docker/seed-demos.sh /app/docker/seed-demos.sh
RUN chmod +x /app/docker/seed-demos.sh

# Patch Analytics
RUN mamba run -n streamlit-env python hooks/hook-analytics.py

# Set Online Deployment
RUN jq '.online_deployment = true' settings.json > tmp.json && mv tmp.json settings.json

# Point the in-app mounted-drive browser at the conventional bind-mount path.
# The browser only renders when this directory exists at runtime, i.e. when
# the user starts the container with `-v /host/path:/mounted-data`.
RUN jq '.local_data_dir = "/mounted-data"' settings.json > tmp.json && mv tmp.json settings.json

# Download latest OpenMS App executable as a ZIP file.
# ARG declared here (not at the top) — otherwise the per-run token busts the cache.
ARG GITHUB_TOKEN
RUN if [ -n "$GITHUB_TOKEN" ]; then \
        echo "GITHUB_TOKEN is set, proceeding to download the release asset..."; \
        gh release download -R ${GITHUB_USER}/${GITHUB_REPO} -p "OpenMS-App.zip" -D /app; \
    else \
        echo "GITHUB_TOKEN is not set, skipping the release asset download."; \
    fi


# Run app as container entrypoint.
EXPOSE $PORT
ENTRYPOINT ["/app/entrypoint.sh"]