# =============================================================================
# OPTIMIZED RUNPOD DEPLOYMENT DOCKERFILE - VOLUME MOUNT ARCHITECTURE
# =============================================================================
# Purpose: Minimal CUDA 13.0 runtime environment for pre-built binaries
# Target Size: ~2-3GB (vs 8GB current)
# Optimizations:
#   - Multi-stage build for runpodctl (eliminates curl/wget from final image)
#   - Runtime-only CUDA base (vs devel, saves ~5GB)
#   - Optional SSH server (build arg controlled)
#   - Single-layer package installation with cleanup
#   - No health checks or unnecessary tools
#
# Architecture:
#   - Docker image: CUDA runtime environment + entrypoint script
#   - Training binaries: Pre-uploaded to Runpod Network Volume at /runpod-volume/binaries/
#   - Test data: Pre-uploaded to Runpod Network Volume at /runpod-volume/test_data/
#   - Credentials: Pre-uploaded to Runpod Network Volume at /runpod-volume/.env
#
# NO COMPILATION IN DOCKER - Binaries are pre-built locally with CUDA support
# =============================================================================

# =============================================================================
# STAGE 1: RUNPODCTL BUILDER (Isolated download stage)
# =============================================================================
FROM ubuntu:24.04 AS runpodctl_builder

# Runpodctl version (update as needed)
ARG RUNPODCTL_VERSION=1.14.11
ARG TARGETARCH=amd64

# Download and extract runpodctl in a single layer
# Using curl (minimal) instead of wget to reduce dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl ca-certificates && \
    curl -fsSL "https://github.com/runpod/runpodctl/releases/download/v${RUNPODCTL_VERSION}/runpodctl_${RUNPODCTL_VERSION}_linux_${TARGETARCH}.tar.gz" \
        -o runpodctl.tar.gz && \
    tar -xzf runpodctl.tar.gz && \
    chmod +x runpodctl && \
    # Cleanup unnecessary files (not copied to final stage)
    rm -rf runpodctl.tar.gz /var/lib/apt/lists/*

# =============================================================================
# STAGE 2: FINAL RUNTIME IMAGE (Minimal CUDA runtime)
# =============================================================================
# Base image: CUDA 13.0 RUNTIME (not devel) on Ubuntu 24.04
# CRITICAL: Using 'runtime' instead of 'devel' saves ~5GB
# Runtime includes: libcuda.so.1, libcurand.so.10, libcublas.so.13, libcublasLt.so.13
# Runtime does NOT include: nvcc, CUDA headers, static libraries, build tools
FROM nvidia/cuda:13.0.0-runtime-ubuntu24.04

# Build argument to control SSH installation (default: false for production)
# Use --build-arg INSTALL_SSH=true for debugging/development images
ARG INSTALL_SSH=false

# Prevent interactive prompts during apt installations
ENV DEBIAN_FRONTEND=noninteractive

# Copy runpodctl binary from builder stage (no download tools in final image)
COPY --from=runpodctl_builder /runpodctl /usr/local/bin/runpodctl

# Install runtime dependencies in a SINGLE layer (critical for size)
# - libcudnn9: cuDNN 9 runtime for CUDA 13.0 (neural network acceleration)
# - openssh-server: Optional SSH server for Runpod remote access
RUN apt-get update && \
    # Install cuDNN 9 runtime (matches local compilation environment)
    apt-get install -y --no-install-recommends \
        libcudnn9 && \
    # Conditionally install SSH server if build arg is true
    if [ "$INSTALL_SSH" = "true" ]; then \
        apt-get install -y --no-install-recommends openssh-server && \
        mkdir -p /var/run/sshd /root/.ssh && \
        chmod 700 /root/.ssh && \
        # Configure SSH for key-only authentication (Runpod injects PUBLIC_KEY)
        sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
        sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config && \
        sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config; \
    fi && \
    # Critical: Remove apt cache to minimize layer size
    rm -rf /var/lib/apt/lists/*

# Set CUDA environment variables (for runtime library loading)
ENV CUDA_HOME=/usr/local/cuda
ENV PATH="${CUDA_HOME}/bin:${PATH}"
ENV LD_LIBRARY_PATH="${CUDA_HOME}/lib64:${LD_LIBRARY_PATH}"

# NVIDIA runtime configuration
ENV NVIDIA_VISIBLE_DEVICES=all
ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility
ENV CUDA_VISIBLE_DEVICES=0

# Rust runtime environment
ENV RUST_BACKTRACE=1
ENV RUST_LOG=info

# Copy entrypoint scripts (self-terminate wrapper + generic base)
COPY entrypoint-generic.sh /entrypoint-generic.sh
COPY entrypoint-self-terminate.sh /entrypoint.sh
RUN chmod +x /entrypoint-generic.sh /entrypoint.sh

# Create workspace directory
WORKDIR /workspace

# Expose SSH port (only used if SSH installed)
EXPOSE 22

# Entrypoint executes training binary from volume mount
# NO DOWNLOADS - binaries and data are already on the mounted Runpod Network Volume
# Override binary via environment variable: BINARY_NAME (default: train_tft_parquet)
ENTRYPOINT ["/entrypoint.sh"]

# Default CMD shows help (deployment script overrides this with dockerStartCmd)
CMD ["--help"]

# =============================================================================
# BUILD INSTRUCTIONS - TWO VARIANTS
# =============================================================================
#
# VARIANT 1: MINIMAL PRODUCTION IMAGE (No SSH, smallest size)
# Recommended for: Runpod Secure Cloud pods (web terminal access)
# Expected size: ~2-3GB
#
#   docker build -f Dockerfile.runpod.optimized \
#     -t jgrusewski/foxhunt:latest .
#
# VARIANT 2: DEBUGGING IMAGE (SSH included)
# Recommended for: Runpod Community Cloud, direct SSH access needed
# Expected size: ~2.2-3.2GB (+200MB for SSH server)
#
#   docker build -f Dockerfile.runpod.optimized \
#     --build-arg INSTALL_SSH=true \
#     -t jgrusewski/foxhunt:ssh .
#
# =============================================================================
# PUSH TO DOCKER HUB
# =============================================================================
#
#   docker login  # Login to Docker Hub as jgrusewski
#   docker push jgrusewski/foxhunt:latest
#   # IMPORTANT: Set repository to PRIVATE in Docker Hub settings
#
# =============================================================================
# SIZE COMPARISON
# =============================================================================
#
# Current (Dockerfile.runpod):        ~8.06GB
#   - CUDA 13.0 devel base:            ~7.5GB
#   - SSH server:                      ~200MB
#   - cuDNN 9 dev:                     ~300MB
#   - wget/curl tools:                 ~50MB
#
# Optimized (Dockerfile.runpod.optimized): ~2-3GB
#   - CUDA 13.0 runtime base:          ~1.8GB  (saves 5.7GB)
#   - SSH server (optional):           ~0-200MB
#   - cuDNN 9 runtime:                 ~150MB  (saves 150MB)
#   - runpodctl (multi-stage):         ~10MB   (saves 40MB)
#   - No build tools:                  ~0MB    (saves 50MB)
#
# TOTAL SAVINGS: ~6GB (75% reduction)
#
# =============================================================================
# DEPLOYMENT SPEED IMPROVEMENTS
# =============================================================================
#
# Docker Pull Time (on Runpod GPU):
#   - Current (8GB):     ~2-3 minutes
#   - Optimized (2.5GB): ~30-60 seconds
#   - Improvement:       60-75% faster
#
# Total Pod Startup:
#   - Current:           ~3-4 minutes
#   - Optimized:         ~1-2 minutes
#   - Improvement:       50-66% faster
#
# =============================================================================
# RUNTIME DEPENDENCIES VERIFIED
# =============================================================================
#
# Required by pre-built binaries (ldd output):
#   ✓ libcuda.so.1          (from CUDA runtime base)
#   ✓ libcurand.so.10       (from CUDA runtime base)
#   ✓ libcublas.so.13       (from CUDA runtime base)
#   ✓ libcublasLt.so.13     (from CUDA runtime base)
#   ✓ libcudnn.so.9         (from libcudnn9 package)
#   ✓ libstdc++6, libgcc-s1 (from Ubuntu 24.04 base)
#
# All dependencies satisfied by 'runtime' image (no 'devel' needed)
#
# =============================================================================
# SECURITY IMPROVEMENTS
# =============================================================================
#
# - Smaller attack surface: No compilers, build tools, or unnecessary packages
# - SSH optional: Disabled by default for production workloads
# - Minimal package count: Only runtime libraries installed
# - Single-layer builds: Easier to audit and scan for vulnerabilities
#
# =============================================================================