📦 feat(inspect): Add docker build

[ashwinvaidya17]

📝 Description

• Add CPU build
• Add GPU build
• Add XPU build
• Add XPU related changes from fix(inspect): Enable training on XPU using SingleXPUStrategy #3210
• Remove trackio as it does not play well with multi-threading when Evaluator is present (needed for early stopping)

✨ Changes

Select what type of change your PR is:

• 🚀 New feature (non-breaking change which adds functionality)
• 🐞 Bug fix (non-breaking change which fixes an issue)
• 🔄 Refactor (non-breaking change which refactors the code base)
• ⚡ Performance improvements
• 🎨 Style changes (code style/formatting)
• 🧪 Tests (adding/modifying tests)
• 📚 Documentation update
• 📦 Build system changes
• 🚧 CI/CD configuration
• 🔧 Chore (general maintenance)
• 🔒 Security update
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)

✅ Checklist

Before you submit your pull request, please make sure you have completed the following steps:

• 📚 I have made the necessary updates to the documentation (if applicable).
• 🧪 I have written tests that support my changes and prove that my fix is effective or my feature works (if applicable).
• 🏷️ My PR title follows conventional commit format.

For more information about code review checklists, see the Code Review Checklist.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 13 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Running the container in privileged mode with full access to /dev is a significant security risk that grants the container nearly unrestricted access to the host system. Consider mapping only specific required devices (e.g., /dev/video0 for webcams) and removing privileged: true unless absolutely necessary for the application's core functionality.

Suggested change

	# Map all host devices to provide access to webcams and other attached devices
	privileged: true
	devices:
	- /dev:/dev
	# Map only required host devices (e.g., webcam) to the container for security.
	# privileged: true # Removed for security; only enable if absolutely necessary.
	# devices:
	# - /dev/video0:/dev/video0 # Example: map only webcam device if needed.

[warrkan]

I'd rather implement it via env variable: https://github.com/open-edge-platform/geti-prompt/blob/main/application/backend/app/main.py#L73

[warrkan]

Should be adjusted further when we introduce Pyinstaller

[warrkan]

Can we omit having nginx by serving UI static using FastAPI?

[maxxgx]

Just a question: why put everything in a parent folder .packaging/?

[MarkRedeman]

Could we move it into application/docker (without .packaging?) no need to hide it imho. This would also align well with the other applications.

[maxxgx]

Should we use backend/run.sh?

[maxxgx]

Could you add example of running the container with camera passthrough? I guess would be a common usecase

[maxxgx]

I've tried to build it and it works. However, couldn't get camera passthrough to work on mac. Have you tested it on linux?

[Copilot]

Pull request overview

Copilot reviewed 11 out of 14 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

application/docker/Dockerfile:1

• The dockerfile path references application/.packaging/docker/Dockerfile, but based on the file structure, the Dockerfile is located at application/docker/Dockerfile. This mismatch will cause the build to fail.

#------------------------------------------

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The directory path in the instructions is incorrect. The actual docker files are in application/docker/, not application/.packaging/docker/. This inconsistency appears in all three build instruction sections and will cause users to encounter errors when following the documentation.

[Copilot]

The function parameter full_path is declared but never used, and there's no logic to prevent potential path traversal attacks or handle different routes. If this endpoint is meant to handle multiple paths, the implementation should use full_path to serve the appropriate files. If it only serves index.html, the parameter should be removed.

Suggested change

	async def get_webui(full_path: str = "") -> FileResponse: # noqa: ARG001
	async def get_webui() -> FileResponse:

[Copilot]

If settings.static_files_dir is None or empty, file_path will not be defined, causing an UnboundLocalError on line 20. The condition should ensure file_path is always defined before the return statement, or raise an appropriate error when static_files_dir is not configured.

Suggested change

	if settings.static_files_dir and not (file_path := Path(settings.static_files_dir) / "index.html").exists():
	if not settings.static_files_dir:
	raise HTTPException(status_code=500, detail="Static files directory is not configured")
	file_path = Path(settings.static_files_dir) / "index.html"
	if not file_path.exists():

[Copilot]

Allowing all origins with allow_origins=[\"*\"] is a security risk in production environments as it permits any domain to make requests to the API. Consider making this configurable through settings and restricting it to specific trusted origins in production.

[Copilot]

The XPU build stage is adding Ubuntu 'jammy' repositories to a Debian-based image (python:3.13-slim is based on Debian). This repository mismatch may cause package installation issues or incompatibilities. Use the appropriate Debian-compatible Intel GPU repository instead.

Suggested change

	&& echo "deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu jammy unified" | \
	tee /etc/apt/sources.list.d/intel-gpu-jammy.list \
	&& echo "deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/debian bookworm unified" | \
	tee /etc/apt/sources.list.d/intel-gpu-bookworm.list \

[Copilot]

Pull request overview

Copilot reviewed 10 out of 13 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The volume mount source path /backend/data is an absolute host path that likely doesn't exist. This should either be a relative path like ./data:/app/data or use a named volume. The same issue exists for the logs volume on line 33.

[Copilot]

The change from sqlite+aiosqlite:///./{path} to sqlite+aiosqlite:///{path} removes the relative path prefix. While this might work for absolute paths, it could break existing deployments using relative paths. Consider maintaining backward compatibility or documenting this breaking change.

[Copilot]

The XPU build stage is based on Debian 12 (bookworm) as indicated by the base image python:3.13-slim, but this configures Ubuntu Jammy (22.04) repositories. This architecture mismatch will likely cause package installation failures or runtime incompatibilities.

Suggested change

	&& echo "deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/ubuntu jammy unified" | \
	tee /etc/apt/sources.list.d/intel-gpu-jammy.list \
	&& echo "deb [arch=amd64,i386 signed-by=/usr/share/keyrings/intel-graphics.gpg] https://repositories.intel.com/gpu/debian bookworm unified" | \
	tee /etc/apt/sources.list.d/intel-gpu-bookworm.list \

[MarkRedeman]

I didn't need this setting while testing on a lunar lake laptop. Though I guess this could differ based on how docker was installed?

[MarkRedeman]

Should this not be ../? (i.e. the application being the context excluding any library files?)

[MarkRedeman]

I think we could omit this, or set PUBLIC_API_BASE_URL="".
When deploying Inspect the UI and backend should be expected to be served on the same hosts, this allows us to avoid security policies like CORS and (later?) have a better CSP configuration.

[MarkRedeman]

I think this should be omitted. The npm install script should clone and install the geti packages with the npm ci command.
If we copy from the host then we risk the docker image containing outdated packages (or at least packages that are not in sync with what's in the anomalib repo).

[MarkRedeman]

For me just running,

AI_DEVICE=xpu docker compose up

was working. (same for build command)

[MarkRedeman]

The docs here mention creating builds, but the commands show up being used, is that intended?

[MarkRedeman]

Perhaps one other thing we could look into is having separate docker-compose.xpu.yaml, docker-compsoe.nvidia.yaml files and tell the user to use these (instead of them uncommenting stuff).

See for instance https://github.com/open-webui/open-webui as an example of a repo using this.

[MarkRedeman]

I would move this file into the application folder, since I think we shouldn't expect users to use docker for the library?

[ashwinvaidya17]

Since the context is the root of anomalib, it needs .dockerignore in the same folder

[Copilot]

Pull request overview

Copilot reviewed 10 out of 13 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The command is missing the required environment variable for the XPU build. For CPU build, it should also set VIDEO_GROUP_ID similar to the XPU example, but it's missing the note about uncommenting the group_add line in docker-compose.yml.

Suggested change

	> [!NOTE]
	> You need to uncomment the `group_add` line in the `docker-compose.yml` file to enable video group permissions.

[Copilot]

The XPU build command should also include VIDEO_GROUP_ID since the docker-compose.yml requires it for video device access. The command should be: RENDER_GROUP_ID=$(getent group render | cut -d: -f3) VIDEO_GROUP_ID=$(getent group video | cut -d: -f3) AI_DEVICE=xpu docker compose up

Suggested change

	RENDER_GROUP_ID=$(getent group render | cut -d: -f3) AI_DEVICE=xpu docker compose up
	RENDER_GROUP_ID=$(getent group render | cut -d: -f3) VIDEO_GROUP_ID=$(getent group video | cut -d: -f3) AI_DEVICE=xpu docker compose up

[Copilot]

The comment mentions 'torch XPU support' but doesn't clarify that users need to uncomment this line when using AI_DEVICE=xpu. The README mentions setting RENDER_GROUP_ID but doesn't explicitly state this line must be uncommented.

Suggested change

	# Uncomment the following lines to enable torch XPU support
	# For more info, see README.md
	group_add:
	# - "${RENDER_GROUP_ID}" # This is needed to allow access to the 'render' group for torch XPU support
	# To enable torch XPU support (when using AI_DEVICE=xpu), you MUST uncomment the RENDER_GROUP_ID line below.
	# For more info, see README.md
	group_add:
	# - "${RENDER_GROUP_ID}" # Uncomment this line when using AI_DEVICE=xpu to allow access to the 'render' group for torch XPU support

[Copilot]

If static_files_dir is None or not set, file_path will be undefined when reaching the return statement, causing a NameError. The logic should handle the case where static_files_dir is None by raising an HTTPException before attempting to return FileResponse.

Suggested change

	if settings.static_files_dir and not (file_path := Path(settings.static_files_dir) / "index.html").exists():
	if not settings.static_files_dir:
	raise HTTPException(status_code=404, detail="Static files directory not set")
	file_path = Path(settings.static_files_dir) / "index.html"
	if not file_path.exists():

[Copilot]

Allowing all origins with '*' in production exposes the application to CSRF attacks. This should be configurable via environment variables or restricted to known origins in production deployments.

[Copilot]

Running the container in privileged mode grants extensive permissions and poses security risks. Consider using specific device permissions and capabilities instead of privileged mode unless absolutely necessary for webcam access.

Suggested change

	# Map all host devices to provide access to webcams and other attached devices
	privileged: true
	devices:
	- /dev:/dev
	# Map only required devices to provide access to webcams and other attached devices
	# privileged: true # Removed for security; use specific device mapping below
	devices:
	- /dev/video0:/dev/video0 # Map only the webcam device; add more as needed

[Copilot]

Pull request overview

Copilot reviewed 10 out of 13 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The variable file_path is only assigned when the condition is True, but it's used unconditionally in the return statement. If settings.static_files_dir is None or empty, file_path will be undefined, causing a NameError. Initialize file_path before the conditional or handle the None case explicitly.

Suggested change

	if settings.static_files_dir and not (file_path := Path(settings.static_files_dir) / "index.html").exists():
	raise HTTPException(status_code=404, detail="File not found")
	file_path = None
	if settings.static_files_dir:
	file_path = Path(settings.static_files_dir) / "index.html"
	if not file_path.exists():
	raise HTTPException(status_code=404, detail="File not found")
	else:
	raise HTTPException(status_code=404, detail="Static files directory not configured")

[Copilot]

Pull request overview

Copilot reviewed 13 out of 16 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Missing 'docker' command prefix. Should be 'docker compose up'.

Suggested change

	compose up
	docker compose up

[Copilot]

The 'Build the container' section uses 'up' which builds and starts the container, not just builds it. Should use 'build' command to match the section heading, or update the heading to reflect that this command both builds and starts.

Suggested change

	docker compose -f docker-compose.cuda.yaml up
	docker compose -f docker-compose.cuda.yaml build

[Copilot]

Changed from specific allowed origins to wildcard '*', which allows requests from any origin. This creates a security vulnerability by disabling CORS protection. Consider restricting to specific trusted origins in production or making this configurable.