[wenh06]

Summary

Containerize the Streamlit web app so it runs as a managed service instead of an ad-hoc nohup process: built-in restart across host reboots, a health check, and a locked, isolated dependency set on top of python:3.12-slim (decoupled from the host's site-packages).

The PyPI package stays library-only — streamlit_app.py is an application, not part of the library, so the image packages it from the repository snapshot (COPY streamlit_app.py) and installs the library from the same tree. Nothing in the packaging configuration changes.

What's in the box

Dockerfile (multi-stage, modern BuildKit idioms):

• builder stage installs the library with the app extra into an isolated /opt/venv; the runtime stage copies only the finished venv — no pip, no build tooling;
• RUN --mount=type=cache,target=/root/.cache/pip keeps pip downloads across rebuilds (the modern replacement for --no-cache-dir);
• unprivileged runtime user (uid 1000); HEALTHCHECK on /_stcore/health; PORT / BASE_URL_PATH overridable via env; exec-form shell CMD so docker stop signals reach streamlit directly;
• OCI labels (title / description / source / licenses) so the registry page links back to this repository;
• SETUPTOOLS_SCM_PRETEND_VERSION build arg pins the version, since hatch-vcs cannot see .git in the build context.

docker-compose.yml (compose v2 spec, no version: key): restart: unless-stopped, binds 127.0.0.1:8501 only — the reverse proxy in front remains the public entry point and is unchanged.

Verification

• image builds with no registry access beyond the (cached) base image;
• docker compose up -d --build → container reports healthy, streamlit 1.66.1 inside;
• through the existing reverse proxy: /_stcore/health → ok, page → 200, websocket upgrade → 101 Switching Protocols;
• container runs as appuser, restart policy unless-stopped.

Notes

• no # syntax= directive: the bundled BuildKit frontend supports everything used here, keeping builds network-independent;
• a future release can add a GHCR publish job to publish.yml (same tag pipeline, GITHUB_TOKEN with packages: write) — deferred until this is proven stable;
• when the app-improvement PR (feat(app): persistent results and multi-slot cache in the Streamlit app #61) merges, a plain docker compose build picks up the new app on the next rebuild.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.61%. Comparing base (4d8925c) to head (60364af).
⚠️ Report is 6 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #62   +/-   ##
=======================================
  Coverage   98.61%   98.61%           
=======================================
  Files          13       13           
  Lines        1944     1944           
=======================================
  Hits         1917     1917           
  Misses         27       27           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.