Dockerfile for SimStadt CLI and Tests

.dockerignore

+.venv
+.git
+.pytest_cache
+.mypy_cache
+*.py[oc]
+dist/
+docs/
+*.egg-info
+
+# Repo cache, e.g. during SimStadt tests
+**/.cache/

Dockerfile

+FROM python:3.11-slim AS base
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG JRE_VERSION=17.0.18+10
+ARG JRE_DEB="bellsoft-jre${JRE_VERSION}-linux-amd64-full.deb"
+ARG JRE_URL=https://download.bell-sw.com/java/${JRE_VERSION}/${JRE_DEB}
+ARG INSEL_VERSION=8.3.4.0b
+ARG INSEL_DEB="insel_${INSEL_VERSION}_x64_mini.deb"
+ARG INSEL_URL=https://insel.eu/download/${INSEL_DEB}
+
+# Java 17 (SimStadt requirement) + INSEL (SimStadt's PV/irradiance workflow steps shell out to it).
+# curl is only a build-time dependency to fetch the JRE/INSEL .deb files; it is installed and
+# removed within this same layer so it never persists in the final image.
+RUN apt-get update && \
+    apt-get install curl --no-install-recommends -y && \
+    curl ${JRE_URL} -o /tmp/${JRE_DEB} -k && \
+    curl ${INSEL_URL} -o /tmp/${INSEL_DEB} -k && \
+    apt-get install /tmp/${JRE_DEB} /tmp/${INSEL_DEB} --no-install-recommends -y && \
+    apt-get remove curl -y && \
+    rm -rf /var/lib/apt/lists/* && \
+    apt-get clean && \
+    rm /tmp/${JRE_DEB} /tmp/${INSEL_DEB}
+
+RUN groupadd -g 1000 simstadt \
+  && useradd simstadt --create-home --shell /bin/bash -u 1000 -g 1000
+
+COPY --from=ghcr.io/astral-sh/uv:0.12.17 /uv /uvx /usr/local/bin/
+
+RUN mkdir -p /opt/venv && chown simstadt:simstadt /opt/venv
+ENV VIRTUAL_ENV=/opt/venv
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
+ENV PATH="/opt/venv/bin:${PATH}"
+
+USER simstadt
+RUN mkdir -p /home/simstadt/app /home/simstadt/Desktop
+WORKDIR /home/simstadt/app
+
+FROM base AS cli
+
+# `simstadt` is unpinned (always the latest PyPI release), and `simstadt --install`
+# always fetches the latest SimStadt build — there's no version/URL override available
+# for either today. This is a deliberate tradeoff for a "real, current" CLI image, not
+# an oversight: it means the build needs network access, and rebuilding this stage later
+# can silently bake in different simstadt/SimStadt versions than a previous build.
+RUN uv venv "$VIRTUAL_ENV" && uv pip install simstadt
+
+RUN simstadt --install
+
+CMD ["simstadt"]
+
+FROM base AS test
+
+COPY --chown=simstadt:simstadt pyproject.toml uv.lock README.md ./
+COPY --chown=simstadt:simstadt src ./src
+COPY --chown=simstadt:simstadt tests ./tests
+
+RUN uv sync --frozen
+
+RUN simstadt --install
+
+# No `-m "not integration"` filter here, deliberately: this image has a real SimStadt/INSEL
+# install (unlike a plain dev machine or CI runner), so its whole point is to run the full
+# suite. The `simple_tests` Makefile target remains the one for the non-integration subset.
+CMD ["uv", "run", "pytest", "-v"]

Makefile

@@ -18,6 +18,20 @@ simple_tests: ## Run simple tests, without running SimStadt
 simstadt: ## Run simstadt script, and display info about SimStadt
 	uv run simstadt
 
+docker-build: ## Build the cli and test Docker images
+	docker build --target cli -t simstadt/simstadt:cli .
+	docker build --target test -t simstadt/simstadt:test .
+
+docker-test: docker-build ## Run the full test suite (incl. integration tests) inside Docker
+	docker run --rm simstadt/simstadt:test
+
+_check_docker_push:
+	@echo -n "Are you sure you want to push the Docker images to Docker Hub? [y/N] " && read ans && [ $${ans:-N} = y ]
+
+docker-push: _check_docker_push docker-build ## Push cli and test images to Docker Hub (requires prior `docker login`)
+	docker push simstadt/simstadt:cli
+	docker push simstadt/simstadt:test
+
 tests_installed_package: ## Tests the installed simstadt package
 	pytest --pyargs simstadt -v
 
@@ -47,4 +61,4 @@ _upload:
 install_editable: ## Install package in dev mode
 	pip install -e .
 
-.PHONY: help tests simstadt build coverage
+.PHONY: help tests simstadt build coverage docker-build docker-test docker-push