sie-server 0.2.0__tar.gz → 0.3.0__tar.gz

{sie_server-0.2.0 → sie_server-0.3.0}/.gitignore

@@ -75,6 +75,9 @@ docs/_build/
 .pybuilder/
 target/
 
+# Rust
+*.rs.bk
+
 # Jupyter Notebook
 .ipynb_checkpoints
 
@@ -247,6 +250,7 @@ Thumbs.db
 
 # kilocode
 .kilo/
+.kilocode/
 
 # Worktree metadata
 .base-branch

sie_server-0.3.0/Dockerfile.cpu

@@ -0,0 +1,198 @@
+# syntax=docker/dockerfile:1
+# SIE Server - CPU-only Image (amd64 + arm64)
+# Build from repo root:
+#   docker build -f packages/sie_server/Dockerfile.cpu -t sie-server:cpu-default .
+#   docker build -f packages/sie_server/Dockerfile.cpu --build-arg BUNDLE=transformers5 -t sie-server:cpu-transformers5 .
+#   docker buildx build --platform linux/amd64,linux/arm64 -f packages/sie_server/Dockerfile.cpu -t sie-server:cpu .
+
+ARG BUNDLE=default
+
+# =============================================================================
+# Stage 1: Dependencies (pyproject.toml only, cached across code changes)
+# =============================================================================
+FROM python:3.12-slim-bookworm AS deps
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    UV_NO_CACHE=1 \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+# build-essential + git are builder-only; they do NOT leak into the runtime stage.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    ca-certificates \
+    curl \
+    git
+
+ARG UV_VERSION=0.9.28
+RUN curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh \
+    && mv /root/.local/bin/uv /bin/uv \
+    && mv /root/.local/bin/uvx /bin/uvx
+
+WORKDIR /app
+
+# Dependency specs first — this layer caches as long as pyproject.toml is unchanged.
+COPY packages/sie_sdk/pyproject.toml /tmp/sie_sdk/pyproject.toml
+COPY packages/sie_server/pyproject.toml ./pyproject.toml
+
+# Stub source trees so pip accepts the editable installs during dep resolution.
+RUN mkdir -p /tmp/sie_sdk/src/sie_sdk src/sie_server \
+    && touch /tmp/sie_sdk/src/sie_sdk/__init__.py \
+    && touch src/sie_server/__init__.py
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python -m venv .venv \
+    && .venv/bin/pip install --upgrade pip \
+    && .venv/bin/pip install \
+        --index-url https://download.pytorch.org/whl/cpu \
+        --extra-index-url https://pypi.org/simple \
+        -e "/tmp/sie_sdk[storage]" \
+        -e ".[gpu-metrics]"
+
+# =============================================================================
+# Stage 2: Base - source install + shared-venv finalization (no BUNDLE)
+# =============================================================================
+# Bundle-agnostic: all base-stage layers are shared across bundles of this
+# platform in local BuildKit cache and in content-addressed registry layers.
+FROM deps AS base
+
+COPY packages/sie_sdk/src /tmp/sie_sdk/src
+COPY packages/sie_server/src src/
+COPY packages/sie_server/bundles bundles/
+COPY packages/sie_server/models models/
+
+# Editable reinstall over the stub stage — keeps ./bundles lookups via CWD
+# working for `sie_server.cli resolve-deps`.
+RUN --mount=type=cache,target=/root/.cache/pip \
+    .venv/bin/pip install --no-deps \
+        -e /tmp/sie_sdk \
+        -e .
+
+# Sanity-check shared venv imports — catches breakage introduced by the
+# shared-deps resolver.
+RUN .venv/bin/python -c "import torch; print(torch.__version__)"
+
+# Register bundle-libs on sys.path. Content is identical across bundles.
+RUN echo "import sys; sys.path.insert(0, '/app/bundle-libs')" \
+    > /app/.venv/lib/python3.12/site-packages/_sie_bundle.pth
+
+# .venv cleanup + stdlib trim — runs here so /app/.venv reaches its final
+# form BEFORE bundle divergence. Largest wins: torch/include, *.a static
+# libs, stripping shared objects. Keep bytecode (cold-start matters more
+# than size).
+RUN set -eux; \
+    cd /app/.venv/lib/python3.12/site-packages; \
+    find . -type d -name '__pycache__' -prune -exec rm -rf {} +; \
+    find . -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete; \
+    find . -type d -name 'tests' -prune -exec rm -rf {} +; \
+    rm -rf torch/test torch/utils/tensorboard torch/utils/bottleneck 2>/dev/null || true; \
+    find torch -type f -name '*.a' -delete 2>/dev/null || true; \
+    find . -type f -name 'RECORD' -path '*dist-info*' -delete; \
+    rm -rf /app/.venv/share/jupyter 2>/dev/null || true; \
+    rm -rf /usr/local/lib/python3.12/test /usr/local/lib/python3.12/idlelib 2>/dev/null || true; \
+    find /app/.venv -exec touch -h -d @0 {} + 2>/dev/null || true
+
+# =============================================================================
+# Stage 3: Builder - bundle-specific deps
+# =============================================================================
+FROM base AS builder
+
+ARG BUNDLE
+
+RUN .venv/bin/python -m sie_server.cli resolve-deps \
+    --bundle "${BUNDLE}" \
+    --models-dir models \
+    --cpu \
+    > /tmp/bundle-requirements.txt \
+    && echo "Bundle ${BUNDLE} requirements:" \
+    && cat /tmp/bundle-requirements.txt
+
+# Bundle-specific deps land in a separate site-packages tree so the shared
+# venv layer stays byte-identical across bundles of the same platform.
+# Even if /tmp/bundle-requirements.txt is empty, create /app/bundle-libs so
+# the runtime `COPY --from` never fails.
+RUN --mount=type=cache,target=/root/.cache/pip \
+    mkdir -p /app/bundle-libs; \
+    if [ -s /tmp/bundle-requirements.txt ]; then \
+        .venv/bin/pip install \
+            --index-url https://download.pytorch.org/whl/cpu \
+            --extra-index-url https://pypi.org/simple \
+            --target=/app/bundle-libs \
+            --no-compile \
+            -r /tmp/bundle-requirements.txt; \
+    fi
+
+# bundle-libs cleanup (symmetric to the .venv cleanup in base).
+RUN set -eux; \
+    if [ -d /app/bundle-libs ]; then \
+        cd /app/bundle-libs; \
+        find . -type d -name '__pycache__' -prune -exec rm -rf {} +; \
+        find . -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete; \
+        find . -type d -name 'tests' -prune -exec rm -rf {} +; \
+        rm -rf torch/test torch/utils/tensorboard torch/utils/bottleneck 2>/dev/null || true; \
+        find torch -type f -name '*.a' -delete 2>/dev/null || true; \
+        find . -type f -name 'RECORD' -path '*dist-info*' -delete; \
+    fi; \
+    find /app/bundle-libs -exec touch -h -d @0 {} + 2>/dev/null || true
+
+# =============================================================================
+# Stage 4: Runtime
+# =============================================================================
+FROM python:3.12-slim-bookworm AS runtime
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    HF_HOME=/app/.cache/huggingface \
+    OMP_NUM_THREADS=4 \
+    MKL_NUM_THREADS=4
+
+# Only the shared libs torch + pillow actually dlopen at runtime.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    libgomp1 \
+    libjpeg62-turbo \
+    libpng16-16
+
+RUN groupadd -g 1000 sie && useradd -u 1000 -g sie -m sie
+
+WORKDIR /app
+
+# --link shared COPYs — produce independent layer tars without parent-dir
+# headers carrying a build-time mtime, so resulting layer digests match
+# across bundles of the same platform. Numeric --chown because --link has
+# no /etc/passwd visible (the sie user exists in the runtime FS but --link
+# layers are created in isolation).
+COPY --link --from=base --chown=1000:1000 /app/.venv /app/.venv
+COPY --link --from=base --chown=1000:1000 /app/src /app/src
+COPY --link --from=base --chown=1000:1000 /tmp/sie_sdk/src /tmp/sie_sdk/src
+COPY --link --from=base --chown=1000:1000 /app/models /app/models
+COPY --link --from=base --chown=1000:1000 /app/bundles /app/bundles
+# Bundle-specific extras — last layer so shared layers above stay cached.
+COPY --link --from=builder --chown=1000:1000 /app/bundle-libs /app/bundle-libs
+
+RUN mkdir -p /app/evals /app/.cache/huggingface && chown -R sie:sie /app/evals /app/.cache
+
+# Declare BUNDLE arg only here, where it is first used (LABEL + ENV),
+# so every RUN/COPY layer above is bundle-agnostic in its cache key.
+ARG BUNDLE
+
+ENV SIE_BUNDLE="${BUNDLE}"
+
+LABEL org.opencontainers.image.title="SIE Server" \
+      org.opencontainers.image.description="Search Inference Engine - ${BUNDLE} bundle (CPU)" \
+      sie.bundle="${BUNDLE}"
+
+USER sie
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/healthz')" || exit 1
+
+ENTRYPOINT ["python", "-m", "sie_server.cli"]
+CMD ["serve", "--host", "0.0.0.0", "--port", "8080", "--models-dir", "/app/models", "--device", "cpu"]

sie_server-0.3.0/Dockerfile.cuda11

@@ -0,0 +1,211 @@
+# syntax=docker/dockerfile:1
+# SIE Server - CUDA 11.8 Image (for older drivers 470+)
+# Build from repo root:
+#   docker build -f packages/sie_server/Dockerfile.cuda11 -t sie-server:cuda11-default .
+#   docker build -f packages/sie_server/Dockerfile.cuda11 --build-arg BUNDLE=sglang -t sie-server:cuda11-sglang .
+
+ARG BUNDLE=default
+ARG UV_VERSION=0.9.28
+
+# =============================================================================
+# Stage 1: uv + standalone Python 3.12 (no deadsnakes PPA)
+# =============================================================================
+FROM nvidia/cuda:11.8.0-cudnn8-devel-ubuntu22.04 AS deps
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    UV_NO_CACHE=1 \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_INSTALL_DIR=/opt/python \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git
+
+ARG UV_VERSION
+RUN curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh \
+    && mv /root/.local/bin/uv /bin/uv \
+    && mv /root/.local/bin/uvx /bin/uvx
+
+RUN uv python install 3.12 \
+    && ln -s "$(uv python find 3.12)" /usr/local/bin/python3.12 \
+    && ln -sf /usr/local/bin/python3.12 /usr/local/bin/python3 \
+    && ln -sf /usr/local/bin/python3.12 /usr/local/bin/python
+
+WORKDIR /app
+
+COPY packages/sie_sdk/pyproject.toml /tmp/sie_sdk/pyproject.toml
+COPY packages/sie_server/pyproject.toml ./pyproject.toml
+
+RUN mkdir -p /tmp/sie_sdk/src/sie_sdk src/sie_server \
+    && touch /tmp/sie_sdk/src/sie_sdk/__init__.py \
+    && touch src/sie_server/__init__.py
+
+# Note: flash-attn prebuilt wheels are not published for cu118, so SDPA
+# fallback is used at runtime (see SIE_ATTENTION_BACKEND below).
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python3.12 -m venv .venv \
+    && .venv/bin/pip install --upgrade pip \
+    && .venv/bin/pip install \
+        --index-url https://download.pytorch.org/whl/cu118 \
+        --extra-index-url https://pypi.org/simple \
+        -e "/tmp/sie_sdk[storage]" \
+        -e ".[gpu-metrics]"
+
+# =============================================================================
+# Stage 2: Base - source install + shared-venv finalization (no BUNDLE)
+# =============================================================================
+# Everything here is bundle-agnostic, so all base-stage layers are shared
+# across bundles of this platform in local BuildKit cache and in registry.
+FROM deps AS base
+
+COPY packages/sie_sdk/src /tmp/sie_sdk/src
+COPY packages/sie_server/src src/
+COPY packages/sie_server/bundles bundles/
+COPY packages/sie_server/models models/
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    .venv/bin/pip install --no-deps \
+        -e /tmp/sie_sdk \
+        -e .
+
+# Sanity-check shared venv imports — catches breakage introduced by the
+# shared-deps resolver.
+RUN .venv/bin/python -c "import torch; print(torch.__version__)"
+
+# Register bundle-libs on sys.path. `sys.path.insert(0, ...)` puts
+# bundle-libs at position 0 so bundle-specific versions shadow shared
+# venv versions. Content is identical across bundles.
+RUN echo "import sys; sys.path.insert(0, '/app/bundle-libs')" \
+    > /app/.venv/lib/python3.12/site-packages/_sie_bundle.pth
+
+# .venv cleanup — runs here so /app/.venv reaches its final form BEFORE
+# bundle divergence. All nvidia-*-cu11 packages kept — torch._C DT_NEEDED
+# links libcufile, libnccl, etc.; removing any breaks `import torch`.
+RUN set -eux; \
+    cd /app/.venv/lib/python3.12/site-packages; \
+    find . -type d -name '__pycache__' -prune -exec rm -rf {} +; \
+    find . -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete; \
+    find . -type d -name 'tests' -prune -exec rm -rf {} +; \
+    rm -rf torch/test torch/utils/tensorboard torch/utils/bottleneck 2>/dev/null || true; \
+    find torch -type f -name '*.a' -delete 2>/dev/null || true; \
+    find . -type f -name 'RECORD' -path '*dist-info*' -delete; \
+    find nvidia -type f -name '*.a' -delete 2>/dev/null || true; \
+    rm -rf /app/.venv/share/jupyter 2>/dev/null || true; \
+    find /app/.venv -exec touch -h -d @0 {} + 2>/dev/null || true
+
+# =============================================================================
+# Stage 3: Builder - bundle-specific deps
+# =============================================================================
+FROM base AS builder
+
+ARG BUNDLE
+
+RUN .venv/bin/python -m sie_server.cli resolve-deps \
+    --bundle "${BUNDLE}" \
+    --models-dir models \
+    > /tmp/bundle-requirements.txt \
+    && echo "Bundle ${BUNDLE} requirements:" \
+    && cat /tmp/bundle-requirements.txt
+
+# Bundle-specific deps land in a separate site-packages tree so the shared
+# venv layer stays byte-identical across bundles of the same platform.
+# The cu11 `default` bundle skips flash-attn (wheel is cu128), so
+# /app/bundle-libs may be empty — create the directory either way so the
+# runtime COPY never fails.
+RUN --mount=type=cache,target=/root/.cache/pip \
+    mkdir -p /app/bundle-libs; \
+    if [ -s /tmp/bundle-requirements.txt ]; then \
+        .venv/bin/pip install \
+            --index-url https://download.pytorch.org/whl/cu118 \
+            --extra-index-url https://pypi.org/simple \
+            --target=/app/bundle-libs \
+            --no-compile \
+            -r /tmp/bundle-requirements.txt; \
+    fi
+
+# bundle-libs cleanup (symmetric to the .venv cleanup in base).
+RUN set -eux; \
+    if [ -d /app/bundle-libs ]; then \
+        cd /app/bundle-libs; \
+        find . -type d -name '__pycache__' -prune -exec rm -rf {} +; \
+        find . -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete; \
+        find . -type d -name 'tests' -prune -exec rm -rf {} +; \
+        rm -rf torch/test torch/utils/tensorboard torch/utils/bottleneck 2>/dev/null || true; \
+        find torch -type f -name '*.a' -delete 2>/dev/null || true; \
+        find . -type f -name 'RECORD' -path '*dist-info*' -delete; \
+        find nvidia -type f -name '*.a' -delete 2>/dev/null || true; \
+    fi; \
+    find /app/bundle-libs -exec touch -h -d @0 {} + 2>/dev/null || true
+
+# =============================================================================
+# Stage 4: Runtime
+# =============================================================================
+FROM nvidia/cuda:11.8.0-base-ubuntu22.04 AS runtime
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    gcc \
+    libc6-dev \
+    libgomp1 \
+    libnuma1
+
+RUN groupadd -g 1000 sie && useradd -u 1000 -g sie -m sie
+
+WORKDIR /app
+
+COPY --link --from=base /opt/python /opt/python
+RUN set -e; \
+    py=$(ls -d /opt/python/cpython-3.12*/bin/python3.12 | head -1); \
+    [ -x "$py" ] || { echo "no standalone python found under /opt/python"; exit 1; }; \
+    ln -sf "$py" /usr/local/bin/python3.12; \
+    ln -sf /usr/local/bin/python3.12 /usr/local/bin/python3; \
+    ln -sf /usr/local/bin/python3.12 /usr/local/bin/python
+
+# --link shared COPYs — produce independent layer tars without parent-dir
+# headers carrying a build-time mtime, so resulting layer digests match
+# across bundles of the same platform. Numeric --chown because --link has
+# no /etc/passwd visible (the sie user exists in the runtime FS but --link
+# layers are created in isolation).
+COPY --link --from=base --chown=1000:1000 /app/.venv /app/.venv
+COPY --link --from=base --chown=1000:1000 /app/src /app/src
+COPY --link --from=base --chown=1000:1000 /tmp/sie_sdk/src /tmp/sie_sdk/src
+COPY --link --from=base --chown=1000:1000 /app/models /app/models
+COPY --link --from=base --chown=1000:1000 /app/bundles /app/bundles
+COPY --link --from=builder --chown=1000:1000 /app/bundle-libs /app/bundle-libs
+
+RUN mkdir -p /app/evals /app/.cache/huggingface && chown -R sie:sie /app/evals /app/.cache
+
+# Declare BUNDLE arg only here, where it is first used (LABEL + ENV),
+# so every RUN/COPY layer above is bundle-agnostic in its cache key.
+ARG BUNDLE
+
+LABEL org.opencontainers.image.title="SIE Server" \
+      org.opencontainers.image.description="Search Inference Engine - ${BUNDLE} bundle (CUDA 11.8)" \
+      sie.bundle="${BUNDLE}"
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    HF_HOME=/app/.cache/huggingface \
+    NVIDIA_VISIBLE_DEVICES=all \
+    NVIDIA_DRIVER_CAPABILITIES=compute,utility \
+    SIE_BUNDLE="${BUNDLE}" \
+    SIE_ATTENTION_BACKEND=sdpa
+
+USER sie
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/healthz')" || exit 1
+
+ENTRYPOINT ["python", "-m", "sie_server.cli"]
+CMD ["serve", "--host", "0.0.0.0", "--port", "8080", "--models-dir", "/app/models"]

sie_server-0.3.0/Dockerfile.cuda12

@@ -0,0 +1,242 @@
+# syntax=docker/dockerfile:1
+# SIE Server - CUDA 12.4 Image
+# Build from repo root:
+#   docker build -f packages/sie_server/Dockerfile.cuda12 -t sie-server:cuda12-default .
+#   docker build -f packages/sie_server/Dockerfile.cuda12 --build-arg BUNDLE=sglang -t sie-server:cuda12-sglang .
+
+ARG BUNDLE=default
+ARG UV_VERSION=0.9.28
+
+# =============================================================================
+# Stage 1: uv + standalone Python 3.12 (no deadsnakes PPA)
+# =============================================================================
+FROM nvidia/cuda:12.4.1-cudnn-devel-ubuntu22.04 AS deps
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    UV_NO_CACHE=1 \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_INSTALL_DIR=/opt/python \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+# Minimal apt footprint: just enough for curl + git; no deadsnakes PPA.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git
+
+ARG UV_VERSION
+RUN curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh \
+    && mv /root/.local/bin/uv /bin/uv \
+    && mv /root/.local/bin/uvx /bin/uvx
+
+# Install a standalone Python 3.12 from python-build-standalone (fully relocatable,
+# glibc 2.17+ compat). This replaces the deadsnakes PPA entirely.
+RUN uv python install 3.12 \
+    && ln -s "$(uv python find 3.12)" /usr/local/bin/python3.12 \
+    && ln -sf /usr/local/bin/python3.12 /usr/local/bin/python3 \
+    && ln -sf /usr/local/bin/python3.12 /usr/local/bin/python
+
+WORKDIR /app
+
+COPY packages/sie_sdk/pyproject.toml /tmp/sie_sdk/pyproject.toml
+COPY packages/sie_server/pyproject.toml ./pyproject.toml
+
+RUN mkdir -p /tmp/sie_sdk/src/sie_sdk src/sie_server \
+    && touch /tmp/sie_sdk/src/sie_sdk/__init__.py \
+    && touch src/sie_server/__init__.py
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    python3.12 -m venv .venv \
+    && .venv/bin/pip install --upgrade pip \
+    && .venv/bin/pip install \
+        -e "/tmp/sie_sdk[storage]" \
+        -e ".[gpu-metrics]"
+
+# =============================================================================
+# Stage 2: Base - source install + shared-venv finalization (no BUNDLE)
+# =============================================================================
+# Everything here is bundle-agnostic, so bundle-specific builds of a given
+# platform share every base-stage layer in local BuildKit cache and in
+# content-addressed registry layers.
+FROM deps AS base
+
+COPY packages/sie_sdk/src /tmp/sie_sdk/src
+COPY packages/sie_server/src src/
+COPY packages/sie_server/bundles bundles/
+COPY packages/sie_server/models models/
+
+# Editable reinstall over the stub stage so runtime path-based lookups
+# (e.g. sie_server.cli resolve-deps reading ./bundles) keep working.
+RUN --mount=type=cache,target=/root/.cache/pip \
+    .venv/bin/pip install --no-deps \
+        -e /tmp/sie_sdk \
+        -e .
+
+# Sanity-check shared venv imports — catches breakage introduced by the
+# shared-deps resolver. flash-attn/sglang need a real GPU and are
+# intentionally not imported here.
+RUN .venv/bin/python -c "import torch; print(torch.__version__)"
+
+# Register bundle-libs on sys.path via a .pth file executed by site.py at
+# interpreter startup. `sys.path.insert(0, ...)` puts bundle-libs at
+# position 0 so bundle-specific versions SHADOW shared venv versions
+# (required for the transformers5 bundle). Content is identical for every
+# bundle, so writing it here keeps the shared venv layer byte-identical.
+RUN echo "import sys; sys.path.insert(0, '/app/bundle-libs')" \
+    > /app/.venv/lib/python3.12/site-packages/_sie_bundle.pth
+
+# Conservative venv cleanup — only things known to be runtime-safe. Keep
+# torch/include (triton JIT compiles against torch C++ headers for
+# sglang/flash-attn custom ops) and keep gcc/libc6-dev at runtime.
+# Main wins: byte-compiled caches, *.a static libs, tests/, RECORD metadata.
+# Runs here (not in builder) so /app/.venv reaches its final form BEFORE
+# bundle divergence, making the runtime COPY cache-hit across bundles.
+RUN set -eux; \
+    cd /app/.venv/lib/python3.12/site-packages; \
+    find . -type d -name '__pycache__' -prune -exec rm -rf {} +; \
+    find . -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete; \
+    find . -type d -name 'tests' -prune -exec rm -rf {} +; \
+    rm -rf torch/test torch/utils/tensorboard torch/utils/bottleneck 2>/dev/null || true; \
+    find torch -type f -name '*.a' -delete 2>/dev/null || true; \
+    find . -type f -name 'RECORD' -path '*dist-info*' -delete; \
+    # All nvidia-*-cu12 packages are kept — torch._C DT_NEEDED links libcufile,
+    # libnccl, and similar; removing any breaks `import torch`.
+    find nvidia -type f -name '*.a' -delete 2>/dev/null || true; \
+    rm -rf /app/.venv/share/jupyter 2>/dev/null || true; \
+    # Normalize mtimes so the cross-stage COPY of /app/.venv produces a
+    # byte-identical tar across bundles of the same platform.
+    find /app/.venv -exec touch -h -d @0 {} + 2>/dev/null || true
+
+# =============================================================================
+# Stage 3: Builder - bundle-specific deps
+# =============================================================================
+FROM base AS builder
+
+ARG BUNDLE
+
+RUN .venv/bin/python -m sie_server.cli resolve-deps \
+    --bundle "${BUNDLE}" \
+    --models-dir models \
+    > /tmp/bundle-requirements.txt \
+    && echo "Bundle ${BUNDLE} requirements:" \
+    && cat /tmp/bundle-requirements.txt
+
+# Bundle-specific deps go into a separate site-packages tree so the shared
+# venv layer stays byte-identical across bundles (default, sglang,
+# transformers5) of the same platform. `.venv/bin/pip` is used as the
+# resolver so shared torch/transformers/nvidia wheels are visible on
+# sys.path and only novel packages land under --target.
+# flash-attn deps carry `sys_platform == 'linux'` markers so they install on
+# Linux (this image) but not on developer machines.
+RUN --mount=type=cache,target=/root/.cache/pip \
+    mkdir -p /app/bundle-libs; \
+    if [ -s /tmp/bundle-requirements.txt ]; then \
+        .venv/bin/pip install \
+            --target=/app/bundle-libs \
+            --no-compile \
+            -r /tmp/bundle-requirements.txt; \
+    fi
+
+# bundle-libs cleanup (symmetric to the .venv cleanup in base). The .venv
+# tree is already final in the base stage; only the per-bundle tree needs
+# cleanup here.
+RUN set -eux; \
+    if [ -d /app/bundle-libs ]; then \
+        cd /app/bundle-libs; \
+        find . -type d -name '__pycache__' -prune -exec rm -rf {} +; \
+        find . -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete; \
+        find . -type d -name 'tests' -prune -exec rm -rf {} +; \
+        rm -rf torch/test torch/utils/tensorboard torch/utils/bottleneck 2>/dev/null || true; \
+        find torch -type f -name '*.a' -delete 2>/dev/null || true; \
+        find . -type f -name 'RECORD' -path '*dist-info*' -delete; \
+        find nvidia -type f -name '*.a' -delete 2>/dev/null || true; \
+    fi; \
+    # Normalize mtimes so rebuilds of the same bundle produce identical layer bytes.
+    find /app/bundle-libs -exec touch -h -d @0 {} + 2>/dev/null || true
+
+# =============================================================================
+# Stage 4: Runtime
+# =============================================================================
+# Use base CUDA image (not devel/runtime) — PyTorch wheels bundle CUDA libs,
+# cuDNN ships inside torch. Saves ~2GB vs `runtime` variant.
+FROM nvidia/cuda:12.4.1-base-ubuntu22.04 AS runtime
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# gcc + libc6-dev: triton JIT compiles CUDA kernels at first use.
+# libnuma1: required by sgl_kernel (SGLang bundle); import fails with a
+#   misleading SM-arch error without it.
+# libgomp1: torch OpenMP runtime.
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    gcc \
+    libc6-dev \
+    libgomp1 \
+    libnuma1
+
+RUN groupadd -g 1000 sie && useradd -u 1000 -g sie -m sie
+
+WORKDIR /app
+
+# Standalone Python 3.12 tree + symlinks (no deadsnakes). Pulled from `base`
+# since /opt/python is established in the deps stage and never touched later.
+COPY --link --from=base /opt/python /opt/python
+RUN set -e; \
+    py=$(ls -d /opt/python/cpython-3.12*/bin/python3.12 | head -1); \
+    [ -x "$py" ] || { echo "no standalone python found under /opt/python"; exit 1; }; \
+    ln -sf "$py" /usr/local/bin/python3.12; \
+    ln -sf /usr/local/bin/python3.12 /usr/local/bin/python3; \
+    ln -sf /usr/local/bin/python3.12 /usr/local/bin/python
+
+# Shared content — identical across bundles of the same platform. Pulled from
+# `base` so every bundle rebuild hits BuildKit's local cache and the resulting
+# registry layers are content-addressed identically, enabling pull-time dedup.
+# Ordered BEFORE the per-bundle COPY so bundle-libs is the only invalidating
+# layer when only BUNDLE changes.
+# --link on shared COPYs: produces an independent layer tar without parent-dir
+# headers carrying a build-time mtime, so the resulting layer digests match
+# across bundles of the same platform and the registry can dedup them.
+# --chown uses numeric IDs because --link doesn't have /etc/passwd visible
+# (the sie user is added in the runtime stage filesystem but --link layers
+# are created in isolation from the destination stage state).
+COPY --link --from=base --chown=1000:1000 /app/.venv /app/.venv
+COPY --link --from=base --chown=1000:1000 /app/src /app/src
+COPY --link --from=base --chown=1000:1000 /tmp/sie_sdk/src /tmp/sie_sdk/src
+COPY --link --from=base --chown=1000:1000 /app/models /app/models
+COPY --link --from=base --chown=1000:1000 /app/bundles /app/bundles
+# Bundle-specific extras — last layer so shared layers above stay cached.
+# A `.pth` file in the shared venv puts /app/bundle-libs at sys.path[0] at startup.
+COPY --link --from=builder --chown=1000:1000 /app/bundle-libs /app/bundle-libs
+
+RUN mkdir -p /app/evals /app/.cache/huggingface && chown -R sie:sie /app/evals /app/.cache
+
+# Declare the BUNDLE arg only here, where it is first used (LABEL + ENV),
+# so every RUN/COPY layer above is bundle-agnostic in its cache key and the
+# resulting layers are content-addressed identically across bundles.
+ARG BUNDLE
+
+LABEL org.opencontainers.image.title="SIE Server" \
+      org.opencontainers.image.description="Search Inference Engine - ${BUNDLE} bundle" \
+      sie.bundle="${BUNDLE}"
+
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    HF_HOME=/app/.cache/huggingface \
+    NVIDIA_VISIBLE_DEVICES=all \
+    NVIDIA_DRIVER_CAPABILITIES=compute,utility \
+    SIE_BUNDLE="${BUNDLE}"
+
+USER sie
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/healthz')" || exit 1
+
+ENTRYPOINT ["python", "-m", "sie_server.cli"]
+CMD ["serve", "--host", "0.0.0.0", "--port", "8080", "--models-dir", "/app/models"]