Containerfile

# syntax=docker/dockerfile:1.27@sha256:bde3983e9c939224420ddaf6b784cc30e09b035a4dea01f581230c50809f372e
# SPDX-License-Identifier: EUPL-1.2
# Copyright 2026 Lusoris
#
# dev/Containerfile — VMAF fork dev-MCP container
#
# Multi-stage build:
#   Stage 1 (build-deps)  — base tools: meson, ninja, nasm, gcc-13, clang-19,
#                           python3.14, pkg-config, git, curl, ca-certificates,
#                           the Vulkan loader and lavapipe (ADR-3137)
#   release-build         — separate manylinux root, glibc 2.28:
#                           the native release
#                           bundle's compiler, nothing else (ADR-1354)
#   Stage 2 (gpu-sdks)    — GPU SDK layer on top of Stage 1:
#                           exact CUDA toolkit release from build-config.env,
#                           Intel oneAPI latest,
#                           ROCm latest (HIP toolchain;
#                           build-only on NVIDIA host)
#   Stage 3 (libvmaf)     — source build of libvmaf with all backends enabled
#                           against an in-tree FFmpeg n9.0.2 (or `FFMPEG_TAG`
#                           build-arg override) with the fork's
#                           `ffmpeg-patches/series.txt` applied
#   Stage 4 (python-env)  — install vmaf-train + vmaf-tune
#                           (MCP is the Go binary vmafx-mcp — ADR-1229)
#
# RUNTIME PREREQUISITES (host):
#   - NVIDIA Container Toolkit for CUDA kernel execution
#     https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html
#   - For HIP kernel execution on AMD hardware: pass /dev/kfd and
#     /dev/dri/renderD<N> (AMD node) into the container. rocm-hip-runtime-dev
#     (installed in the image) provides libhsa-runtime64.so + libamdhip64.so;
#     no additional host-side ROCm userspace install is needed beyond the
#     kernel driver (amdgpu module) and device nodes being accessible.
#   - For SYCL kernel execution on Intel Arc: pass /dev/dri/renderD<N> (Intel
#     node) into the container. intel-opencl-icd + libze-intel-gpu1 (installed
#     in the image) provide the compute-runtime GPU ICD; libumf.so.1 and the
#     Level Zero loader (libze1) are also in the image. No additional host-side
#     Intel driver install is needed beyond the i915/xe kernel module and the
#     DRI device node being accessible.
#
# See docs/development/dev-mcp.md for full usage.

# ---------------------------------------------------------------------------
# Stage 0 — rocm-src (ROCm 10.1.0 payload, pruned)
# ---------------------------------------------------------------------------
# **Why an image and not apt (ADR-1225).** Since ROCm 7.14 AMD builds and
# releases through "TheRock". The legacy apt channel at repo.radeon.com/rocm/apt/
# tops out at 7.2.4 — its own `latest` resolves there, and both apt/7.14 and
# apt/10.0.0 return 404. The manylinux channel stops at rocm-rel-7.2.4 and the
# TheRock wheel index carries only 7.14.0 alphas, so the official container
# image is the only stable, digest-pinnable ROCm 10 artifact today.
#
# The 10.1.0 -full image carries 21 GB under /opt/rocm, ~15 GB of which is math
# libraries libvmaf never links: hipBLASLt, hipSPARSELt, rocBLAS, MIOpen's
# per-gfx convolution kernels, Composable Kernel's device-op archives, RCCL,
# rocFFT / rocSPARSE / rocSOLVER / rocRAND, RPP (new in 10.1.0) and the
# profiler runtimes. Pruning them takes the COPY below from 21 GB to 5.8 GB.
# Every entry of the list matched in 10.1.0; re-check it on each ROCm bump. Keep lib/llvm (hipcc needs
# it to emit .hsaco), the HIP / HSA / comgr runtimes, the amdgcn device
# bitcode, the headers -- and `librocprofiler-register`, which despite the
# name is a hard link-time dependency of libamdhip64.so.
# Base images come from build-config.env -- the single source of truth for
# every container base in this repository. These defaults are mirrors kept in
# sync by scripts/ci/check-base-image-single-source.sh; edit the config, not
# these lines, then run `make base-images-sync`.
#
# They must precede the FIRST FROM: an ARG declared after one is scoped to the
# stage it follows, so `FROM ${ROCM_BUILDER}` above would expand to nothing.
ARG DEV_BASE="ubuntu:26.04@sha256:6a06111c3b0a8600feadb270aec771dc239bf407b25625f93f44ab00e11f4d3c"
ARG NATIVE_RELEASE_BUILDER_BASE="quay.io/pypa/manylinux_2_28_x86_64@sha256:7e41b1c7fd64dfc69703a1124b43c404382973ee06ec5d764b85c34d2221fded"
ARG DEV_GO_BASE="golang:1.27-trixie@sha256:c47c3fda018d13d43a6bf5ebac3e5bba8a23a35782aa4faf531afaf47c64c39f"
ARG ROCM_BUILDER="rocm/dev-ubuntu-26.04:10.1.0-full@sha256:4f5ed1bf6532a4b9920400401b0ad0f706af356dae61e40afefbfd6c8073f0ce"

FROM ${ROCM_BUILDER} AS rocm-src

ARG RL=/opt/rocm/core-10.1/lib
RUN rm -rf \
        ${RL}/hipblaslt ${RL}/hipsparselt ${RL}/rocblas ${RL}/rdc \
        ${RL}/rocprofiler-systems ${RL}/rocprofiler-compute \
        ${RL}/libdevice_*_operations.a ${RL}/librocshmem.a \
        ${RL}/librocroller.so* ${RL}/librocjitsu.so* \
        ${RL}/libMIOpen*.so* ${RL}/librocsparse* ${RL}/librocsolver* \
        ${RL}/librocfft* ${RL}/librocrand* ${RL}/librocblas* \
        ${RL}/libhipblas* ${RL}/libhipfft* ${RL}/libhipsparse* \
        ${RL}/libhipsolver* ${RL}/libhiprand* ${RL}/librccl* \
        ${RL}/librocprof-sys* ${RL}/librocprofiler-sdk* ${RL}/librpp* \
        /opt/rocm/core-10.1/share/miopen \
    && du -sh /opt/rocm

# ROCm 10 puts the real tree under /opt/rocm/core-<major>.<minor>/ and makes
# /opt/rocm/{bin,lib,include,llvm,share,libexec,amdgcn} symlinks into
# /etc/alternatives/rocm-*. A `COPY --from` of /opt/rocm alone would land a
# directory of dangling symlinks in the consuming stage, because
# /etc/alternatives is not copied with it -- and copying that instead would
# collide with the consuming image's own alternatives. Repoint each link at
# the core directory relative to /opt/rocm so the tree is self-contained.
#
# The hipcc smoke check gates the prune list above: `librocprofiler-register`
# in particular must NOT be pruned (libamdhip64.so links it), and an
# over-wide glob here fails the build rather than shipping an image whose
# HIP binaries die at load.
RUN for entry in /opt/rocm/*; do \
        [ -L "$entry" ] || continue; \
        case "$(readlink "$entry")" in /etc/alternatives/*) ;; *) continue ;; esac; \
        name="$(basename "$entry")"; \
        if [ -e "/opt/rocm/core-10.1/$name" ]; then \
            ln -sfn "core-10.1/$name" "$entry"; \
        else \
            ln -sfn "core-10.1" "$entry"; \
        fi; \
    done \
    && test -x /opt/rocm/bin/hipcc \
    && test -e /opt/rocm/lib/libamdhip64.so \
    && /opt/rocm/bin/hipconfig --version \
    && printf '%s\n' '#include <hip/hip_runtime.h>' \
        '__global__ void vmafx_rocm_smoke(int *p) { p[threadIdx.x] = threadIdx.x; }' \
        'int main() { return 0; }' > /tmp/vmafx-rocm-smoke.hip \
    && /opt/rocm/bin/hipcc --offload-arch=gfx1036 \
        /tmp/vmafx-rocm-smoke.hip -o /tmp/vmafx-rocm-smoke \
    && LD_LIBRARY_PATH=/opt/rocm/lib /tmp/vmafx-rocm-smoke \
    && rm -f /tmp/vmafx-rocm-smoke.hip /tmp/vmafx-rocm-smoke

# ---------------------------------------------------------------------------
# Stage 1 — build-deps
# ---------------------------------------------------------------------------
# every container base in this repository. These defaults are mirrors kept in

FROM ${DEV_BASE} AS build-deps

# Declare the shell in each stage with pipelines so failures stay visible.
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

LABEL org.opencontainers.image.title="vmaf-dev-mcp-build-deps"
LABEL org.opencontainers.image.description="Base build tools for VMAF fork dev-MCP container"
LABEL org.opencontainers.image.source="https://github.com/VMAFx/vmafx"
# No org.opencontainers.image.licenses here: this stage holds distribution
# packages and SDK tools only, no VMAFx file. libvmaf-build, the published
# target, states the licences of the VMAFx files it copies (ADR-1699).

# Container-only publishing marker (ADR-1102, docs/development/publishing.md).
# `scripts/ci/check-container-build.sh` reads this file to tell a container
# build from a host build; without it the container-only publishing policy is
# documentation with nothing enforcing it. Written in the FIRST stage so every
# downstream stage (gpu-sdks, libvmaf-build, go-build, dev-mcp) inherits it.
# `release-build` is a separate root and writes the same bytes (ADR-1354).
# Keep the key names in sync with the gate script and with its unit test
# (scripts/ci/tests/test-check-container-build.sh), which requires both
# writes to match.
RUN printf '%s\n' \
    'vmafx_dev_container=1' \
    'image_title=vmaf-dev-mcp' \
    'containerfile=dev/Containerfile' \
    'source=https://github.com/VMAFx/vmafx' \
    > /etc/vmafx-dev-container \
    && chmod 0644 /etc/vmafx-dev-container

ARG DEBIAN_FRONTEND=noninteractive
ARG RR_APT_VERSION=5.9.0-5

# BuildKit cache mounts on /var/cache/apt and /var/lib/apt let sequential
# rebuilds reuse the downloaded .deb files and the package index. With the
# cache mount in place we INTENTIONALLY drop the trailing
# `rm -rf /var/lib/apt/lists/*` — the cache lives in a tmpfs-backed mount
# that does not get baked into the resulting image layer.
# hadolint ignore=DL3008,DL3009
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
    # Toolchains
    ccache \
    gcc-13 \
    g++-13 \
    clang-19 \
    clang++-19 \
    libclang-rt-19-dev \
    # vmafx-node's eBPF object is compiled at build time (ADR-1622): clang's
    # BPF target, llvm-strip and the libbpf headers
    llvm-19 \
    libbpf-dev \
    # Build system
    meson \
    ninja-build \
    nasm \
    pkg-config \
    cmake \
    # Python — Ubuntu 26.04 (Resolute Raccoon) ships Python 3.14 as the
    # default interpreter; python3.12 is not available in the distro archive.
    # ADR-0603.
    python3.14 \
    python3.14-venv \
    python3.14-dev \
    python3-pip \
    # Source control + fetch
    git \
    git-lfs \
    curl \
    ca-certificates \
    gnupg \
    # Runtime libs needed by libvmaf and ONNX Runtime
    libgomp1 \
    libzimg2 \
    libzimg-dev \
    libc6-dev \
    libglvnd-dev \
    libva-dev \
    libva-drm2 \
    libdrm-dev \
    libvpl-dev \
    vainfo \
    ripgrep \
    "rr=${RR_APT_VERSION}" \
    # VA-API user-space drivers (Intel + AMD). The libva-dev / libva-drm2
    # pair above only provides the VA-API headers and DRM transport — the
    # actual codec driver (`iHD_drv_video.so` for Intel, `radeonsi_drv_video.so`
    # for AMD) lives in these two packages. Without them, the
    # `*_qsv` / `*_vaapi` encoders fail with `vaInitialize ... unknown libva
    # error`. ADR-0541.
    # NOTE: `mesa-va-drivers` was renamed to `mesa-libgallium` in Ubuntu 26.04
    # (Resolute Raccoon). The gallium package ships the same
    # `radeonsi_drv_video.so` (AMD) and `iris_drv_video.so` (Intel) VA-API
    # backends; only the package name changed. ADR-0603.
    intel-media-va-driver-non-free \
    mesa-libgallium \
    # Vulkan loader, headers and Mesa's CPU Vulkan driver lavapipe (ADR-3137,
    # operator decision ci-config-19): every lane that builds in this image
    # configures meson with dependency('vulkan') found, so the VMAFx Vulkan
    # frame-import tests build and the tidy lanes measure them; their Vulkan
    # side runs on lavapipe with no GPU. vulkan-tools carries vulkaninfo for
    # the check below. Real-GPU Vulkan runs stay a separate signal.
    libvulkan1 \
    libvulkan-dev \
    mesa-vulkan-drivers \
    vulkan-tools \
    xxd \
    # Misc
    jq

# Verify critical GPU/VA-API packages were actually installed.
# A misconfigured repo or network failure during apt-get produces a silently
# broken image; this check surfaces the gap at build time instead of run time.
RUN for pkg in intel-media-va-driver-non-free mesa-libgallium libvpl-dev \
        libvulkan1 libvulkan-dev mesa-vulkan-drivers vulkan-tools; do \
        # Use `dpkg -l` (installed-package DB), not `apt-mark showmanual`: the
        # BuildKit cache mount at /var/lib/apt is shared across builds, so a
        # package auto-installed in an earlier cached layer stays flagged
        # Auto-Installed even after an explicit install (a false negative here).
        dpkg -l "${pkg}" 2>/dev/null | grep -q "^ii" \
            || (echo "FATAL: ${pkg} was not installed" && exit 1); \
    done

# The Vulkan loader must find lavapipe with no GPU in sight (ADR-3137): the
# build host exposes no /dev/dri, so this is the CPU-only case every hosted
# lane runs in. Fails the build when the ICD is missing or the loader does not
# enumerate it.
RUN vulkaninfo --summary 2>/dev/null | grep -E 'deviceName[[:space:]]*=[[:space:]]*llvmpipe' \
    || (echo "FATAL: the Vulkan loader does not enumerate lavapipe" && vulkaninfo --summary; exit 1)

# Ensure gcc-13 / clang-19 are the default compilers.
# gcc-ar, gcc-nm and gcc-ranlib follow gcc. This stage installs no default
# `gcc` package, so it has no unversioned gcc-ar and no
# /usr/lib/bfd-plugins/liblto_plugin.so. Meson archives static libraries with
# `gcc-ar` when it exists and otherwise falls back to plain `ar`, which then
# cannot index GCC LTO objects: every LTO link against libvmaf.a (the unit
# tests) fails with undefined references. The native release build ran in
# this stage under ADR-1346 and moved to `release-build` (ADR-1354); the fix
# stays so the full default target set keeps linking in this stage.
RUN update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-13 100 \
        --slave /usr/bin/gcc-ar gcc-ar /usr/bin/gcc-ar-13 \
        --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-13 \
        --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-13 \
    && update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-13 100 \
    && update-alternatives --install /usr/bin/clang clang /usr/bin/clang-19 100 \
    && update-alternatives --install /usr/bin/clang++ clang++ /usr/bin/clang++-19 100

# ClangBuildAnalyzer (Unlicense, ADR-3336) build-time analysis
ARG CLANGBUILDANALYZER_VERSION=1.6.0
ARG CLANGBUILDANALYZER_SHA256=868a8d34ecb9b65da4e5874342062a12c081ce4385c7ddd6ce7d557a0c5c292d
RUN curl -fsSL \
        "https://github.com/aras-p/ClangBuildAnalyzer/archive/refs/tags/v${CLANGBUILDANALYZER_VERSION}.tar.gz" \
        -o /tmp/cba.tar.gz \
    && echo "${CLANGBUILDANALYZER_SHA256}  /tmp/cba.tar.gz" | sha256sum -c - \
    && tar -xzf /tmp/cba.tar.gz -C /tmp \
    && cmake -G Ninja -S "/tmp/ClangBuildAnalyzer-${CLANGBUILDANALYZER_VERSION}" -B /tmp/cba-build \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_INSTALL_PREFIX=/usr/local \
    && cmake --build /tmp/cba-build -j2 \
    && cmake --install /tmp/cba-build \
    && test -x /usr/local/bin/ClangBuildAnalyzer \
    && rm -rf /tmp/cba.tar.gz /tmp/cba-build "/tmp/ClangBuildAnalyzer-${CLANGBUILDANALYZER_VERSION}"

# Create a non-root build user (CERT C ENV32 — do not run builds as root).
# uid/gid 2000 are pinned so BuildKit `--mount=type=cache,uid=2000,gid=2000`
# directives below resolve to the same identity that runs the build.
# GID/UID 1000 are reserved by Ubuntu 26.04 (Resolute Raccoon) for the
# built-in `ubuntu` group / user that ships in the base image; using 1000
# causes `groupadd` to exit 4 (GID in use). GID/UID 2000 is safe on all
# Ubuntu LTS releases up to and including 26.04. ADR-0603.
RUN groupadd --gid 2000 vmaf \
    && useradd --uid 2000 --gid 2000 --create-home --shell /bin/bash vmaf \
    && mkdir -p /home/vmaf/.cache/ccache \
    && chown -R vmaf:vmaf /home/vmaf/.cache

# ---------------------------------------------------------------------------
# release-build — downloadable bundles with a glibc 2.28 floor (issue 2437)
# ---------------------------------------------------------------------------
# Separate root: no libraries copied from the newer development/release images.
# The stage builder selects the matching pinned manylinux image for the host
# architecture. GCC 14 and patchelf come from that digest; the Python build
# tools use the existing hash lock. xxd embeds the built-in models.
FROM ${NATIVE_RELEASE_BUILDER_BASE} AS release-build

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

LABEL org.opencontainers.image.title="vmafx-release-build"
LABEL org.opencontainers.image.description="manylinux glibc 2.28 compiler for the VMAFx native Linux bundles"
LABEL org.opencontainers.image.source="https://github.com/VMAFx/vmafx"
# No org.opencontainers.image.licenses: this stage holds build tools
# packages only; the source it compiles is mounted at run time (ADR-1699).

# The same container marker build-deps writes (ADR-1102). The gate accepts one
# identity for every stage of this file, and the unit suite requires both
# writes to carry identical bytes.
RUN printf '%s\n' \
    'vmafx_dev_container=1' \
    'image_title=vmaf-dev-mcp' \
    'containerfile=dev/Containerfile' \
    'source=https://github.com/VMAFx/vmafx' \
    > /etc/vmafx-dev-container \
    && chmod 0644 /etc/vmafx-dev-container

ENV PATH="/opt/python/cp314-cp314/bin:${PATH}"
ENV CC=gcc CXX=g++

COPY requirements/locks/build.txt /build/requirements/build.txt
ARG NATIVE_NASM_VERSION=3.02
ARG NATIVE_NASM_SHA256=87336eba53b4acfe917424ab5d500d2b0054d9f5148d35c2273ccf2cfb712f0d
# hadolint ignore=DL3041
RUN for attempt in 1 2 3; do \
        dnf -y install --setopt=retries=10 --setopt=skip_if_unavailable=False \
            vim-common zimg-devel git pkgconf-pkg-config \
        && break || { \
            if [ "$attempt" -eq 3 ]; then exit 1; fi; \
            echo "dnf install attempt $attempt failed; cleaning metadata and retrying..." >&2; \
            dnf clean metadata; \
            sleep 2; \
        }; \
    done \
    && dnf clean all \
    && python3 -m pip install --no-cache-dir --require-hashes \
        -r /build/requirements/build.txt \
    && command -v xxd && command -v patchelf

# AlmaLinux 8's assembler predates the AVX-512 sources. Build the maintained
# assembler from the upstream release tarball, verified before extraction.
RUN curl --fail --location --show-error \
        --output /tmp/nasm.tar.xz \
        "https://www.nasm.us/pub/nasm/releasebuilds/${NATIVE_NASM_VERSION}/nasm-${NATIVE_NASM_VERSION}.tar.xz" \
    && echo "${NATIVE_NASM_SHA256}  /tmp/nasm.tar.xz" | sha256sum --check --strict \
    && mkdir /tmp/nasm-src \
    && tar -xJf /tmp/nasm.tar.xz -C /tmp/nasm-src --strip-components=1 \
    && cd /tmp/nasm-src \
    && ./configure --prefix=/usr/local \
    && make -j2 \
    && make install \
    && rm -rf /tmp/nasm-src /tmp/nasm.tar.xz

# ---------------------------------------------------------------------------
# Stage 2 — gpu-sdks
# ---------------------------------------------------------------------------
FROM build-deps AS gpu-sdks

ARG DEBIAN_FRONTEND=noninteractive

# Use pipefail so piped curl/gpg commands fail fast on any segment failure
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# ---------- CUDA 13.4 (ADR-1306) -------------------------------------------
# Ubuntu 26.04 (Resolute) + glibc 2.43 context (ADR-0603, ADR-1306):
#
#   - The NVIDIA ubuntu2604 apt repo carries the cuda-keyring and the exact
#     cuda-toolkit-13-4 / nvcc / cudart package versions recorded in
#     build-config.env.
#
#   - The shared installer's `full` mode constrains the toolkit meta-package,
#     nvcc, and both cudart packages with apt `package=version` operands, then
#     verifies the installed dpkg versions. A CUDA series name alone is not a pin.
#     Ubuntu 26.04 ships glibc 2.43, whose `bits/mathcalls.h` declares
#     `rsqrt(double)` with `noexcept(true)`. CUDA 13.2+ resolved the
#     re-declaration mismatch under NVCC.
#
#   - Fix B (belt-and-suspenders): `-D__MATH_NO_INLINES` is also added
#     to the nvcc flags in `core/src/meson.build`.  That flag tells
#     glibc to suppress the inline math-function definitions that carry
#     the noexcept annotation, eliminating the conflict even if a future
#     CUDA patch version accidentally re-introduces the mismatch.
#
# Note: The NVIDIA Container Toolkit must be installed on the *host* for GPU
# passthrough. The full mode never installs `libcuda1`; the driver comes from
# nvidia-container-runtime at run time. See docs/development/dev-mcp.md.
COPY build-config.env scripts/ci/install-cuda-toolkit.sh /tmp/
# hadolint ignore=DL3008,DL3009
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    /tmp/install-cuda-toolkit.sh --mode=full /tmp \
    && rm -f /tmp/install-cuda-toolkit.sh /tmp/build-config.env

# CUDA_HOME is the symlink the shared installer validates and repoints at this
# exact major.minor (/usr/local/cuda → /usr/local/cuda-NN.M).
ENV CUDA_HOME=/usr/local/cuda
ENV PATH=${CUDA_HOME}/bin:${PATH}
ENV LD_LIBRARY_PATH=${CUDA_HOME}/lib64

# ---------- Intel oneAPI latest (icpx / Level Zero) -------------------------
# Intel apt repo. Use the unversioned `intel-basekit` meta-package — Intel
# does not publish year-quarter-versioned meta-packages (e.g.,
# `intel-basekit-2025.3` does not exist in the apt repo); the versioning is
# tracked internally by the component packages the meta-package pulls in.
RUN curl -fsSL https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB \
        | gpg --dearmor \
        | tee /usr/share/keyrings/intel-sw-products.gpg > /dev/null \
    && printf 'deb [signed-by=/usr/share/keyrings/intel-sw-products.gpg] https://apt.repos.intel.com/oneapi all main\n' \
        > /etc/apt/sources.list.d/intel-oneapi.list

# hadolint ignore=DL3008,DL3009
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
    intel-basekit

# ---------- Intel GPU compute-runtime (Arc / Xe dispatch via Level Zero) ----
# Intel's "compute-runtime" stack (NEO) is what makes Arc / Xe / Gen12 GPUs
# visible to SYCL/OpenCL. It consists of three layers that must version-match
# the host kernel's i915 / xe UAPI:
#
#   intel-opencl-icd       → /usr/lib/x86_64-linux-gnu/intel-opencl/libigdrcl.so
#                            (OpenCL GPU ICD for Gen12/Xe/Arc hardware)
#   libze-intel-gpu1       → /usr/lib/x86_64-linux-gnu/libze_intel_gpu.so.1
#                            (Level Zero GPU ICD — what the Level Zero loader
#                            probes to expose Arc hardware to SYCL programs)
#   intel-igc-core-2 +
#   intel-igc-opencl-2     → /usr/lib/x86_64-linux-gnu/libigc.so.2 +
#                            libigdfcl.so.2 (graphics compiler the NEO runtime
#                            calls to JIT-compile SPIR-V kernels for the GPU)
#   libigdgmm12            → /usr/lib/x86_64-linux-gnu/libigdgmm.so.12 (Intel
#                            Graphics Memory Management — managed by the GPU
#                            ICD for surface/BO allocation)
#   intel-ocloc            → /usr/bin/ocloc (offline compiler; icpx runs it to
#                            compile the SYCL spir64_gen AOT images at build
#                            time, and the Linux oneAPI compiler does not ship
#                            it — without it configure refuses, ADR-1360)
#
# **Why NOT use Intel's noble/unified APT repo for these (ADR-0541).**
# As of 2026-05-18 the Intel apt repo only carries up to
# intel-opencl-icd 25.18.33578.15 (June 2025). NEO 25.18 does not understand
# the i915 / KFD UAPI shipped by Linux kernel ≥ 7.0, so on hosts running
# CachyOS 7.0.x (and any other distro tracking mainline post-7.x), zeInit()
# returns ZE_RESULT_ERROR_UNINITIALIZED (0x78000001) and sycl-ls reports
# `Platforms: 0` even though /dev/dri/renderD<N> for the Arc card is passed
# through and accessible. Host-side current Arch packages work; pinning the
# container to the matching compute-runtime GitHub release fixes the
# in-container fallback-to-CPU regression.
#
# clinfo is installed in the same layer as the NEO .debs to avoid a
# separate apt-get update/install round (saves one image layer). ADR-0790.
# The matched set of Intel NEO runtime, gmmlib, IGC and ocloc packages is
# derived dynamically from the release pinned as INTEL_NEO_VERSION in
# build-config.env (ADR-1145); CI build hosts install that release's ocloc
# through scripts/ci/install-intel-ocloc.sh, so both compile with one IGC.
# The IGC debs install into /usr/local/lib without an ldconfig trigger, hence
# the explicit ldconfig before anything loads them.
COPY build-config.env /opt/vmafx/build-config.env
COPY dev/scripts/fetch-intel-neo.py /tmp/fetch-intel-neo.py
# hadolint ignore=DL3003,DL3008,DL3009
RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN,required=false \
    --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    . /opt/vmafx/build-config.env \
    && apt-get update && apt-get install -y --no-install-recommends clinfo \
    && mkdir -p /tmp/neo && cd /tmp/neo \
    && token_args=() \
    && if [[ -n "${GITHUB_TOKEN:-}" ]]; then token_args=(--github-token "${GITHUB_TOKEN}"); fi \
    && python3 /tmp/fetch-intel-neo.py --neo-ver "${INTEL_NEO_VERSION}" "${token_args[@]}" \
    && apt-get update \
    && apt-get install -y --no-install-recommends ./*.deb \
    && ldconfig \
    && cd / && rm -rf /tmp/neo /tmp/fetch-intel-neo.py

# Verify NEO compute-runtime packages were actually installed, and that ocloc
# is the pinned release (icpx looks for exactly `ocloc` on PATH).
RUN . /opt/vmafx/build-config.env \
    && for pkg in intel-opencl-icd libze-intel-gpu1 intel-ocloc; do \
        dpkg -l "${pkg}" 2>/dev/null | grep -q "^ii" \
            || (echo "FATAL: ${pkg} was not installed" && exit 1); \
    done \
    && test "$(ocloc query OCL_DRIVER_VERSION | tail -n 1)" = "${INTEL_NEO_VERSION}"

# Level Zero loader (libze_loader) for SYCL
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    . /opt/vmafx/build-config.env \
    && curl -fsSL "https://github.com/oneapi-src/level-zero/releases/download/v${LEVEL_ZERO_VERSION}/libze1_${LEVEL_ZERO_VERSION}%2Bu24.04_amd64.deb" -o /tmp/libze1.deb \
    && curl -fsSL "https://github.com/oneapi-src/level-zero/releases/download/v${LEVEL_ZERO_VERSION}/libze-dev_${LEVEL_ZERO_VERSION}%2Bu24.04_amd64.deb" -o /tmp/libze-dev.deb \
    && apt-get update \
    && apt-get install -y --no-install-recommends /tmp/libze1.deb /tmp/libze-dev.deb \
    && find /tmp -maxdepth 1 -name 'libze*.deb' -delete

# ---------- Rust toolchain (ADR-3318) ---------------------------------------
# The version is build-config.env's RUST_VERSION, the one rust-toolchain.toml,
# every crate's rust-version and the Rust workflow name; check-workflow-versions.py
# refuses a literal here. rustup-init is a pinned release with its published
# SHA-256, so the download is checked before it runs. The toolchain lives
# under /opt/rust, readable by the vmaf user, so libvmaf-compile can build the
# Rust extractors (-Denable_rust_features=true).
ARG RUSTUP_INIT_VERSION=1.29.1
ARG RUSTUP_INIT_SHA256=dda7234360b7f578ca8b0ddcb80145646fa61a67c1720a5abc7051b35c9fcb71
ENV RUSTUP_HOME=/opt/rust/rustup \
    CARGO_HOME=/opt/rust/cargo
RUN . /opt/vmafx/build-config.env \
    && curl -fsSL "https://static.rust-lang.org/rustup/archive/${RUSTUP_INIT_VERSION}/x86_64-unknown-linux-gnu/rustup-init" -o /tmp/rustup-init \
    && echo "${RUSTUP_INIT_SHA256}  /tmp/rustup-init" | sha256sum -c - \
    && chmod +x /tmp/rustup-init \
    && /tmp/rustup-init -y --no-modify-path --profile minimal \
        --default-toolchain "${RUST_VERSION}" --component rustfmt,clippy \
    && rm -f /tmp/rustup-init \
    && chmod -R a+rX /opt/rust \
    && test "$(/opt/rust/cargo/bin/rustc --version | cut -d' ' -f2)" = "${RUST_VERSION}"
ENV PATH=/opt/rust/cargo/bin:${PATH}

# ---------- Intel oneVPL GPU runtime (QSV encode dispatch) -----------------
# `libvpl-dev` installs the dispatcher (`libvpl.so.2`) but not the Gen GPU
# implementation (`libmfx-gen.so`). FFmpeg can compile `--enable-libvpl`
# without it, but every `*_qsv` dummy encode fails at runtime with
# "Error creating a MFX session: -9" on Arc. Build the pinned Intel GPU
# runtime from source into the Debian multiarch library directory that the
# distro oneVPL dispatcher searches by default, so QSV works without
# per-command ONEVPL_SEARCH_PATH overrides.
ARG VPL_GPU_RT_TAG=intel-onevpl-26.2.4
# hadolint ignore=DL3003
RUN --mount=type=cache,target=/root/.cache/ccache,sharing=locked,id=ccache-dev-mcp \
    CCACHE_DIR=/root/.cache/ccache \
    git clone --depth=1 --branch "${VPL_GPU_RT_TAG}" https://github.com/intel/vpl-gpu-rt.git /tmp/vpl-gpu-rt \
    && cd /tmp/vpl-gpu-rt \
    && git lfs pull \
    && cmake -S . -B build \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_INSTALL_PREFIX=/usr \
        -DCMAKE_INSTALL_LIBDIR=lib/x86_64-linux-gnu \
        -DCMAKE_C_COMPILER_LAUNCHER=ccache \
        -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
        -DBUILD_RUNTIME=ON \
        -DBUILD_TESTS=OFF \
        -DBUILD_TOOLS=OFF \
        -DENABLE_ITT=OFF \
    && cmake --build build -j"$(nproc)" \
    && cmake --install build \
    && ldconfig \
    && test -e /usr/lib/x86_64-linux-gnu/libmfx-gen.so \
    && rm -rf /tmp/vpl-gpu-rt

# oneAPI env — source /opt/intel/oneapi/setvars.sh in interactive shells;
# for CI/build steps we set the critical vars explicitly.
#
# ONEAPI_ROOT/umf/latest/lib must be in LD_LIBRARY_PATH so that the oneAPI
# Unified Runtime Level Zero adapter (libur_adapter_level_zero.so.0) can
# dlopen libumf.so.1 at startup.  Without it every UR adapter load fails with
# "libumf.so.1: cannot open shared object file" and sycl-ls reports
# "No platforms found" even though the Arc GPU is visible to the kernel.
# Confirmed via LD_DEBUG=libs on the host before landing this fix.
#
# ONEAPI_ROOT/tcm/latest/lib supplies libhwloc.so.15 — the level-zero UR
# adapter dlopen()s libhwloc at adapter load time to enumerate NUMA topology
# even before it touches a device. Without tcm/latest/lib on LD_LIBRARY_PATH
# both `libur_adapter_level_zero.so.0` and `libur_adapter_level_zero_v2.so.0`
# fail to load with "libhwloc.so.15: cannot open shared object file" and the
# loader skips straight to the OpenCL/CUDA/HIP adapters which can't drive an
# Arc GPU. ADR-0509 / Research-0138; verified via strace + ZE_LOADER_DEBUG_TRACE
# inside the container against host RTX 4090 + Intel Arc A380 + AMD gfx1036.
#
# ONEAPI_ROOT/tbb/latest/lib supplies libtbb.so.12 — the Intel CPU OpenCL ICD
# (/opt/intel/oneapi/compiler/latest/lib/libintelocl.so) dlopen()s libtbb at
# OpenCL platform-enumeration time. Without tbb/latest/lib on
# LD_LIBRARY_PATH the Khronos ocl-icd loader logs
# `Failed to load driver because libtbb.so.12: cannot open shared object file`
# and clinfo reports zero platforms even with the Intel GPU stack working.
# ADR-0541.
ENV ONEAPI_ROOT=/opt/intel/oneapi
ENV DPCPP_ROOT=${ONEAPI_ROOT}/compiler/latest
ENV PATH=${DPCPP_ROOT}/bin:${PATH}
ENV LD_LIBRARY_PATH=${DPCPP_ROOT}/lib:${ONEAPI_ROOT}/umf/latest/lib:${ONEAPI_ROOT}/tcm/latest/lib:${ONEAPI_ROOT}/tbb/latest/lib:${LD_LIBRARY_PATH}
ENV PKG_CONFIG_PATH=${ONEAPI_ROOT}/tbb/latest/lib/pkgconfig

# ---------- ROCm 10.1.0 (HIP toolchain + runtime) --------------------------
# NOTE: HIP kernel dispatch on AMD hardware requires /dev/kfd and
# /dev/dri/renderD<N> (AMD node) to be passed into the container at runtime.
# On a host with no AMD GPU the HIP runtime returns an error for device ops;
# the container is still useful for build-regression catching and static
# analysis. See docs/development/dev-mcp.md §Known Limitations.
#
# The payload comes from the digest-pinned `rocm-src` stage above rather than
# from repo.radeon.com — see that stage's comment for why (ADR-1225).
#
# **KFD ABI (supersedes the ADR-0541 6.4 pin).** ROCm userspace talks to the
# kernel's KFD ioctl ABI, and a mismatch surfaces as
# `Unable to open /dev/kfd read-write: Invalid argument` plus a silent CPU
# fallback — which is what ROCm 6.4 did against a 7.x kernel. ROCm 10.0.0 was
# verified end-to-end on the dev host (Linux 7.2.3, gfx1036), and 10.1.0 again
# on Linux 7.2.9, where the HIP device suite returns what a 10.0.0 build of the
# same tree returns: the agent
# enumerates, `amdgpu-arch` reports gfx1036 natively, and a HIP-backend VMAF
# score matches the CPU exactly. HSA_OVERRIDE_GFX_VERSION is no longer needed.
#
# **Layout.** ROCm 10.1 installs under /opt/rocm/core-10.1 and makes
# /opt/rocm/lib a Debian-alternatives symlink onto it, so the ROCM_PATH /
# PATH / LD_LIBRARY_PATH settings below are unchanged from the 7.x layout.
# Note that the image self-reports HIP 7.16.x — the HIP component version is
# not the ROCm release version.
COPY --from=rocm-src /opt/rocm /opt/rocm

# ROCm's bundled LLD links against libxml2; Ubuntu 26.04 (Resolute) renamed the
# shared library from libxml2.so.2 to libxml2.so.16. The compat symlink
# satisfies the dynamic linker at .hsaco link time. The ABI is backward
# compatible — the soname major was bumped for packaging reasons, the C API is
# unchanged. ADR-0603.
# hadolint ignore=DL3008,DL3009
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
    libxml2-16 \
    && ln -sf /usr/lib/x86_64-linux-gnu/libxml2.so.16.1.2 \
              /usr/lib/x86_64-linux-gnu/libxml2.so.2

# Fail the build here rather than at `meson setup -Denable_hip=true` if the
# copy landed short.
RUN test -x /opt/rocm/bin/hipcc \
        || (echo "FATAL: hipcc missing from /opt/rocm" && exit 1) \
    && test -e /opt/rocm/lib/libamdhip64.so \
        || (echo "FATAL: libamdhip64.so missing from /opt/rocm" && exit 1) \
    && /opt/rocm/bin/hipconfig --version

ENV ROCM_PATH=/opt/rocm
ENV PATH=${ROCM_PATH}/bin:${ROCM_PATH}/llvm/bin:${PATH}
ENV LD_LIBRARY_PATH=${ROCM_PATH}/lib:${LD_LIBRARY_PATH}

# ---------- Build-time GPU runtime visibility probes -----------------------
# Emit sycl-ls / clinfo / rocminfo output during image build so that any
# install gap surfaces in the build log rather than silently at container
# startup. In a standard BuildKit sandbox these may show "No platforms found"
# or CPU-only (no GPU device node passthrough during build) — expected and
# non-fatal (|| true). The output is still captured for diagnosis.
RUN echo "=== sycl-ls (SYCL device visibility) ===" \
    && sycl-ls 2>&1 || true \
    && echo "=== clinfo --list (OpenCL platform/device list) ===" \
    && clinfo --list 2>&1 || true \
    && echo "=== rocminfo agents ===" \
    && rocminfo 2>&1 | grep -E "Agent|Name:|Device Type|gfx" || true

# ---------------------------------------------------------------------------
# Stage 3 — libvmaf source build
# ---------------------------------------------------------------------------
# The libvmaf and FFmpeg builds run in stages of their own (libvmaf-compile,
# ffmpeg-compile), and the stages the image is made of copy only what each one
# installs, from a staging root (DESTDIR). A build tree removed in a later RUN
# stays in the layer that made it: the Meson tree alone was 8.25 GB of the
# image, the FFmpeg checkout and objects another 1.1 GB (ADR-0790 removed both
# that way). The chain:
#   libvmaf-deps     sources, ONNX Runtime, nv-codec-headers
#   libvmaf-compile  meson setup + ninja, installs into /stage/libvmaf (discarded)
#   codec-deps       installed libvmaf, the backend probe, encoder libraries
#   ffmpeg-compile   patched FFmpeg, installs into /stage/ffmpeg (discarded)
#   libvmaf-build    installed FFmpeg and the encoder probe; go-build and dev-mcp
#                    derive from it, and CI builds it as its gate (ADR-0819)
FROM gpu-sdks AS libvmaf-deps

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
WORKDIR /build/vmaf

# The licences of the VMAFx files this stage copies and builds (the union of
# their SPDX headers, else REUSE.toml; ADR-1513 decision 6, ADR-1699), which
# dev-mcp inherits. FFmpeg (configured with --enable-nonfree) and the vendor
# SDKs keep their own terms; that is why the image stays private (ADR-1564).
LABEL org.opencontainers.image.licenses="EUPL-1.2 AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-3-Clause-Clear AND BSD-2-Clause AND ISC AND MIT AND Unlicense AND LicenseRef-LIVE-BRISQUE AND LGPL-2.1-or-later AND GPL-2.0-or-later"

# Copy only the build-needed subtrees — NOT the full repo root.
#
# Root cause for this explicit list: when `docker compose -f dev/docker-compose.yml`
# is invoked without --project-directory, Docker Compose v2 sets the project
# directory to the compose-file's parent (dev/), making `context: .` resolve to
# dev/ rather than the repo root. As a result the root .dockerignore is never
# consulted, and the entire repo root (including .corpus/ at 781 GB) is sent to
# the daemon on every build. The runtime bind-mount (source: ., target: /workspace)
# already provides the full tree at run-time, so baking it in is unnecessary.
#
# Directories included:
#   core/           — meson source (the actual library + feature extractors).
#                     Renamed from libvmaf/ per ADR-0700; the meson source dir
#                     is now `core/` and is passed to `meson setup` below.
#   compat/         — Python harness package (was python/vmaf/); pip-installed
#                     via the `python/` shim, but the compat/ tree itself must
#                     be present in the build context for the editable install
#                     to resolve. ADR-0700.
#   ffmpeg-patches/ — patch series applied in stage 3.5
#   cmd/vmafx-mcp/  — MCP JSON-RPC server (Go; installed to
#                     /usr/local/bin by the go-build stage, ADR-1229)
#   ai/             — tiny-AI training harness (pip install -e)
#   tools/          — vmaf-tune CLI (pip install -e)
#   python/         — Python bindings shim added to PYTHONPATH
#                     (re-exports from compat/python-vmaf/, ADR-0700)
#   model/          — VMAF model JSON/ONNX files (VMAF_MODEL_PATH)
#   testdata/       — YUV fixtures for smoke tests (VMAF_TESTDATA_PATH;
#                     runtime bind-mount shadows this at run-time)
#   dev/            — entrypoint + helper scripts (ENTRYPOINT reference)
#   scripts/        — CI helper scripts (assertion-density, copyright check)
#
# COPY --chown transfers ownership of file *contents*, but the /build/vmaf
# directory itself is owned by root because Docker's WORKDIR directive always
# creates directories as root.  Without chown-ing the directory entry, the vmaf
# user cannot create the meson build subdir (os.makedirs → EACCES → meson
# reports as OSError).  chown /build too so that future sub-directories created
# inside /build by vmaf (e.g., /build/ffmpeg) are not blocked either.
COPY --chown=vmaf:vmaf core/           /build/vmaf/core/
COPY --chown=vmaf:vmaf compat/         /build/vmaf/compat/
COPY --chown=vmaf:vmaf ffmpeg-patches/ /build/vmaf/ffmpeg-patches/
COPY --chown=vmaf:vmaf mcp-server/     /build/vmaf/mcp-server/
COPY --chown=vmaf:vmaf ai/             /build/vmaf/ai/
COPY --chown=vmaf:vmaf tools/          /build/vmaf/tools/
COPY --chown=vmaf:vmaf python/         /build/vmaf/python/
COPY --chown=vmaf:vmaf model/          /build/vmaf/model/
COPY --chown=vmaf:vmaf testdata/       /build/vmaf/testdata/
COPY --chown=vmaf:vmaf dev/            /build/vmaf/dev/
COPY --chown=vmaf:vmaf scripts/        /build/vmaf/scripts/
RUN chown vmaf:vmaf /build /build/vmaf

# Install ONNX Runtime C++ shared library (provides pkg-config .pc file so
# meson can find it for -Denable_dnn=enabled). ONNX Runtime is not in Ubuntu
# apt; we pull the official Linux x86_64 tarball from GitHub releases.
# This CPU archive supplies the native C/C++ API, not CUDA or ROCm execution
# providers. Provider-enabled ORT distributions need their matching runtime
# dependencies (ADR-0113). The Python runtime floor is owned independently
# by ai/pyproject.toml.
ARG ORT_VERSION=1.30.0
ARG ORT_SHA256=a5ed5a3cac51fbb2e90da632ae43d19212faaa20e76484e62bcb7c23ddb3b3fd
RUN curl -fsSL \
        "https://github.com/microsoft/onnxruntime/releases/download/v${ORT_VERSION}/onnxruntime-linux-x64-${ORT_VERSION}.tgz" \
        -o /tmp/ort.tgz \
    && echo "${ORT_SHA256}  /tmp/ort.tgz" | sha256sum --check --strict - \
    && tar -xzf /tmp/ort.tgz -C /tmp \
    && cp -r /tmp/onnxruntime-linux-x64-${ORT_VERSION}/include/* /usr/local/include/ \
    && cp -r /tmp/onnxruntime-linux-x64-${ORT_VERSION}/lib/* /usr/local/lib/ \
    && rm -rf /tmp/ort.tgz /tmp/onnxruntime-linux-x64-${ORT_VERSION} \
    && ldconfig \
    && printf "prefix=/usr/local\nexec_prefix=\${prefix}\nlibdir=\${exec_prefix}/lib\nincludedir=\${prefix}/include\n\nName: libonnxruntime\nDescription: ONNX Runtime C++ API\nVersion: %s\nLibs: -L\${libdir} -lonnxruntime\nCflags: -I\${includedir}\n" "${ORT_VERSION}" \
        > /usr/local/lib/pkgconfig/libonnxruntime.pc

USER vmaf

# Configure with all backends enabled.
# meson.build lives in core/ (not the repo root); pass the source dir
# explicitly as the first positional argument to `meson setup`. ADR-0700.
# -Denable_metal=auto  → auto-disabled on Linux (no Metal SDK present).
# -Denable_mcp_sse=auto → auto-disabled until POSIX socket impl is complete.
USER root
# Install nv-codec-headers (provides ffnvcodec/dynlink_cuda.h for CUDA backend).
# Pinned to a tag that has cuStreamCreateWithPriority.
#
# Two sources, tried in order. code.ffmpeg.org is upstream's own host and stays
# first; github.com/FFmpeg/nv-codec-headers is the fallback. The original comment
# here said "GitHub mirror lags so use code.ffmpeg.org", which is true for an
# unreleased commit but not for a TAG: n13.1.15.0 is published on both, and the
# GitHub tarball carries the cuStreamCreateWithPriority declaration this pin
# exists for (verified in include/ffnvcodec/dynlink_loader.h).
#
# The fallback is not hypothetical tidiness. On 2026-09-06 code.ffmpeg.org was
# unreachable for over six hours -- `curl` returning HTTP 000 after a 30 s
# timeout -- which stalled this layer and made the dev container, the canonical
# build environment under CLAUDE.md rule 15, unbuildable for that whole window.
# A single unreachable host should not be able to do that.
#
# The primary is given a deliberately short leash (--retry 1, --max-time 60):
# with a working fallback behind it, spending minutes on an unreachable host is
# pure latency. Measured with the first draft's generous settings (--retry 3,
# --max-time 120), the layer took 487 s to fall through to GitHub and succeed;
# the tightened values cut that to roughly two minutes while leaving the healthy
# path -- one 0.5 s fetch -- untouched.
#
# Note the two archives unpack to DIFFERENT top-level directory names
# (`nv-codec-headers` from code.ffmpeg.org, `nv-codec-headers-<tag>` from
# GitHub), so make targets the extracted directory rather than a fixed name.
ARG NV_CODEC_HEADERS_REF=n13.1.15.0
RUN { curl -fsSL --retry 1 --retry-delay 2 --connect-timeout 10 --max-time 60 \
           "https://code.ffmpeg.org/FFmpeg/nv-codec-headers/archive/${NV_CODEC_HEADERS_REF}.tar.gz" \
           -o /tmp/nv-codec-headers.tgz \
         || { echo "nv-codec-headers: code.ffmpeg.org unreachable, falling back to the GitHub mirror" >&2; \
              curl -fsSL --retry 3 --retry-delay 2 --connect-timeout 20 --max-time 120 \
                "https://github.com/FFmpeg/nv-codec-headers/archive/refs/tags/${NV_CODEC_HEADERS_REF}.tar.gz" \
                -o /tmp/nv-codec-headers.tgz; }; } \
    && tar xzf /tmp/nv-codec-headers.tgz -C /tmp \
    && src_dir="$(find /tmp -maxdepth 1 -type d -name 'nv-codec-headers*' -print -quit)" \
    && test -n "$src_dir" \
    && test -f "$src_dir/include/ffnvcodec/dynlink_cuda.h" \
    && grep -q cuStreamCreateWithPriority "$src_dir/include/ffnvcodec/dynlink_loader.h" \
    && make -C "$src_dir" install PREFIX=/usr/local \
    && find /tmp -maxdepth 1 -name 'nv-codec-headers*' -exec rm -rf {} +

USER vmaf

# ---------------------------------------------------------------------------
# libvmaf-compile: the Meson build tree exists only in this stage.
# ---------------------------------------------------------------------------
FROM libvmaf-deps AS libvmaf-compile
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
WORKDIR /build/vmaf
USER vmaf

# SYCL is built with AOT compilation by default (ADR-0567).
# The default sycl_icpx_aot_targets list covers Arc dGPU (dg2-g10/g11,
# acm-g10/g11/g12) plus every common Intel iGPU from Tiger Lake through
# Battlemage. The fat binary also embeds a SPIR-V JIT fallback for any
# unlisted device. This eliminates the several-second cold-start compilation
# that Level Zero / IGC would otherwise perform on the first kernel launch.
#
# To shrink the binary for a single-target fleet (e.g. Arc A380 = dg2-g11):
#   -Dsycl_icpx_aot_targets='dg2-g11'
#
# To revert to SPIR-V JIT only (smallest binary, first-run penalty):
#   -Dsycl_icpx_aot_targets=''
# ccache cache mount: persists compilation cache across image rebuilds so a
# touch-once-build-everywhere cycle doesn't pay the full nvcc/icpx/hipcc compile
# cost again. Meson auto-detects ccache when it's on PATH; passing the
# environment hint keeps the cache scoped to the dev-mcp image.
#
# ADR-1317 / T-DEV-IMAGE-ICX-NATIVE-FMA-DRIFT-2026-09-30: do not pass -march=native
# to the reference binary build. Intel icx contracts multiply-adds when FMA is
# enabled by -march=native, causing SpEED and CPU extractor scores to drift from
# default builds.
#
# Hybrid toolchain (ADR-3357): CPU C code is built by GCC,
# C++ and the SYCL kernels by icpx. b_lto stays false: GCC LTO objects cannot
# go through the icpx link. glibc libm comes from ADR-1495's link policy, the
# strict FP model for icpx's C++ from ADR-1461 / ADR-3357's project arguments.
# CUDA/HIP host C is GCC-built too.
RUN --mount=type=cache,target=/home/vmaf/.cache/ccache,sharing=locked,uid=2000,gid=2000,id=ccache-dev-mcp-vmaf \
    export CCACHE_DIR=/home/vmaf/.cache/ccache CARGO_HOME=/home/vmaf/.cargo \
    && CC=gcc CXX=icpx meson setup core/build core \
        -Denable_cuda=true \
        -Denable_sycl=true \
        -Denable_hip=true \
        -Denable_hipcc=true \
        -Denable_metal=auto \
        -Denable_dnn=enabled \
        -Denable_mcp=true \
        -Denable_mcp_stdio=true \
        -Denable_mcp_uds=true \
        -Denable_mcp_sse=auto \
        -Denable_rust_features=true \
        --buildtype=release \
        -Db_lto=false \
        --prefix=/usr/local \
    && ninja -C core/build \
    && test -s core/build/src/libvmafx_core_rs.a

USER root
# Install into a staging root. codec-deps copies only that root, so the build
# dir (CUDA PTX/SASS, SYCL AOT fat binaries, HIP .co objects, C object files)
# reaches no layer of the image.
RUN DESTDIR=/stage/libvmaf ninja -C core/build install

# ---------------------------------------------------------------------------
# codec-deps: installed libvmaf, the backend probe, the encoder libraries.
# ---------------------------------------------------------------------------
FROM libvmaf-deps AS codec-deps
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
WORKDIR /build/vmaf
USER root
COPY --from=libvmaf-compile /stage/libvmaf/ /
RUN ldconfig

# ---------- Build-time backend smoke probe ---------------------------------
# Walk every GPU backend the meson configure step claims to have enabled and
# run a tiny vmaf invocation against the Netflix golden CPU pair. The probe
# is a soft-gate: backends that need device passthrough (CUDA/SYCL/HIP)
# will report "no device" or "not available" inside BuildKit's no-GPU sandbox,
# which is non-fatal (|| echo WARN). What we actually catch here is the
# "built without X support" class of regression — i.e. if a future commit
# silently flips `-Denable_hip=true` to false (the precise failure mode that
# motivated ADR-0514 in the first place), the WARN line for backend=hip will
# read "built without hip support" instead of "no device", and the image
# build log will surface the regression on every rebuild.
#
# LD_LIBRARY_PATH must include `/usr/local/lib` for this RUN because libvmaf.so.3
# is installed there (libvmaf-compile's staging root, copied above) and the
# prior gpu-sdks ENV layers pinned LD_LIBRARY_PATH to CUDA/oneAPI/ROCm
# directories only — `ldconfig` runs after the copy (root) but the dlopen()er
# here is the vmaf process, and bash
# `LD_LIBRARY_PATH=…` makes the dependency explicit.
#
# After a working run-time `docker compose up -d` with GPU passthrough,
# `docker exec vmaf-dev-mcp /build/vmaf/dev/scripts/dev-mcp-probe.sh`
# repeats the same probe with real devices and writes results to /probes/.
USER vmaf

# ---------- Netflix golden-pair YUV fixtures ----------------------------------
# Fetch the canonical src01 / checkerboard YUV pairs used by
# python/test/quality_runner_test.py and feature_extractor_test.py so that
# `pytest python/test/` passes inside the container without any host-side
# manual provisioning.  Uses the same script and md5 pinning as CI
# (scripts/test/fetch-test-yuvs.sh, ADR-0493).  Download failures are fatal
# here to catch network-policy regressions at build time; if GitHub is
# unreachable in a CI sandbox the build fails loudly rather than silently
# producing a container whose Python test suite always errors.
RUN bash /build/vmaf/scripts/test/fetch-test-yuvs.sh

# Use the 48-frame `testdata/{ref,dis}_576x324_48f.yuv` fixtures (always
# present in the build context per testdata/) rather than the Netflix
# golden CPU pair under python/test/resource/yuv/ which is fetched
# above, for the backend smoke probe.
RUN for B in cpu cuda sycl hip; do \
      echo "--- probe: backend=$B ---" ; \
      LD_LIBRARY_PATH=/usr/local/lib:${LD_LIBRARY_PATH} \
      vmaf --reference /build/vmaf/testdata/ref_576x324_48f.yuv \
           --distorted /build/vmaf/testdata/dis_576x324_48f.yuv \
           --width 576 --height 324 --pixel_format 420 --bitdepth 8 \
           --backend $B --json --output /tmp/probe_$B.json 2>&1 | head -3 \
        || echo "WARN: backend=$B failed at container-build time (expected for GPU backends without device passthrough; check 'built without X support' as a real regression signal)" ; \
    done

# ---------------------------------------------------------------------------
# Stage 3.5 — FFmpeg n9.0.2 with our libvmaf integration patches
# ---------------------------------------------------------------------------
# Builds the same FFmpeg version the fork's `ffmpeg-patches/series.txt` is
# pinned against. Applies every patch in series order, then configures with
# `--enable-libvmafx`. Result: `ffmpeg -filters` lists `vmafx`,
# `vmafx_pre`, `vmafx_tune` so the dev
# MCP probe can shell out to a real FFmpeg toolchain end-to-end.
USER root

# Codec dependencies for FFmpeg n9.0.2 build:
#
#   libx264-dev      H.264 software encoder
#   libx265-dev      H.265 software encoder
#   libvpx-dev       VP8/VP9 software encoder (libvpx-vp9)
#   libdav1d-dev     AV1 software *decoder*
#   libaom-dev       AV1 software encoder + decoder (alliance for open media)
#   libfdk-aac-dev   AAC encoder (nonfree-gated)
#   libmp3lame-dev   MP3 encoder
#   libopus-dev      Opus encoder/decoder
#   libvorbis-dev    Vorbis encoder/decoder
#   libass-dev       Subtitle renderer
#   libfreetype-dev  Font glyph rendering for drawtext
#   libfontconfig-dev / libfribidi-dev  Font matching + bidi for subtitle layout
#   libva-dev        VA-API (Intel/AMD video accel headers — used by qsv/vaapi)
#   libvdpau-dev     VDPAU (NVIDIA video accel headers — legacy decode path)
#   libvpl-dev       Intel oneVPL runtime (modern replacement for libmfx;
#                    enables `h264_qsv` / `hevc_qsv` / `av1_qsv` via
#                    `--enable-libvpl`). Already pulled in stage 1 but
#                    re-listed for documentation.
#
# SVT-AV1 and libaom are intentionally NOT installed from apt:
#
#   * libsvtav1-dev (Ubuntu) ships the library and headers but omits
#     the `SvtAv1Enc.pc` pkg-config file (a Debian packaging quirk
#     verified 2026-05-18 against `ubuntu:24.04`: only `aom.pc` and
#     `vpl.pc` land in `/usr/lib/x86_64-linux-gnu/pkgconfig/`).
#     FFmpeg's `require_pkg_config libsvtav1 SvtAv1Enc ...` configure
#     probe therefore fails with `ERROR: SvtAv1Enc >= 0.9.0 not found
#     using pkg-config` even when the library is present on disk.
#
#   * libaom-dev: patch 0043's ROI helper in `libavcodec/libaomenc.c`
#     sets `aom_roi_map_t` fields (`enabled`, `skip`, `ref_frame`,
#     `delta_qp_enabled`) that first shipped in libaom 3.13.0, so a
#     build against an older libaom fails with
#     `'aom_roi_map_t' has no member named 'enabled'` etc. libaom is
#     not enabled at all for now; see the libaom note below.
#
# SVT-AV1 is built from source in a dedicated layer below (analogous
# to libvvenc and AMF), which installs a pinned upstream release under
# `/usr/local/` with the correct headers + .pc file.
#
# hadolint ignore=DL3008,DL3009
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
    libx264-dev libx265-dev libvpx-dev libdav1d-dev \
    libfdk-aac-dev libmp3lame-dev libopus-dev libvorbis-dev \
    libass-dev libfreetype-dev libfontconfig-dev libfribidi-dev \
    libva-dev libvdpau-dev libvpl-dev

# NOTE: libaom (Alliance for Open Media reference AV1 encoder) is
# intentionally NOT built or enabled.
#
# The shared fix series patch `0043-libavcodec-unified-qpfile-across-libx264-libsvtav1-l.patch`
# adds a `qpfile_aom_apply_roi` helper to `libavcodec/libaomenc.c`
# that references `aom_roi_map_t` fields (`enabled`, `skip`,
# `ref_frame`, `delta_qp_enabled`). These fields require libaom >= 3.13.0
# (first release with those fields; v3.12.1 and older lack them).
# The dev container base (Ubuntu 26.04) ships 3.13.1 (has the fields);
# libaom remains omitted until a separate build change adds `libaom-dev`
# and `--enable-libaom` and a patch-stack build proves it.
# The node builder base (Debian 13) ships 3.12.1 (lacks the fields);
# enabling there needs libaom >= 3.13.0.
#
# Disposition: SVT-AV1 (built above) is the production AV1 lane
# anyway (Intel / Netflix maintain it as the fast software encoder);
# libaom-av1 is the slow reference rarely used in production
# pipelines. Dropping it from the in-image FFmpeg costs `libaom-av1`
# in the compare-sweep matrix but keeps the fork's patch stack
# rebase-stable.

# ---- SVT-AV1 (Scalable Video Tech for AV1) source build ---------------------
# Built from upstream because Ubuntu's `libsvtav1-dev` package omits
# `SvtAv1Enc.pc` (see comment above). Upstream's `cmake --install`
# always writes `SvtAv1Enc.pc` under `${CMAKE_INSTALL_PREFIX}/lib/
# pkgconfig/`, which the FFmpeg `--enable-libsvtav1` configure probe
# resolves via PKG_CONFIG_PATH.
#
# Pin to a release tag that FFmpeg n9.0.2's configure accepts
# (`SvtAv1Enc >= 0.9.0`) and that ships modern presets (`-preset 6` /
# `-preset 8` are the rate-quality knobs vmaf-tune's compare sweep
# exercises). Tags 2.x are current at time of writing; 2.1.0 is a
# stable LTS-flavoured cut.
ARG SVTAV1_VERSION=4.2.0
RUN --mount=type=cache,target=/root/.cache/ccache,sharing=locked,id=ccache-dev-mcp \
    CCACHE_DIR=/root/.cache/ccache \
    git clone --depth=1 --branch "v${SVTAV1_VERSION}" \
        https://gitlab.com/AOMediaCodec/SVT-AV1.git /tmp/SVT-AV1 \
    && cmake -S /tmp/SVT-AV1 -B /tmp/SVT-AV1/build \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_INSTALL_PREFIX=/usr/local \
        -DCMAKE_C_COMPILER_LAUNCHER=ccache \
        -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
        -DBUILD_SHARED_LIBS=ON \
        -DBUILD_APPS=OFF \
        -DBUILD_TESTING=OFF \
    && cmake --build /tmp/SVT-AV1/build -j"$(nproc)" \
    && cmake --install /tmp/SVT-AV1/build \
    && ldconfig \
    && rm -rf /tmp/SVT-AV1

# ---- libvvenc (Fraunhofer Versatile Video Coding reference encoder) ---------
# Not in Ubuntu apt. Build the VVenC reference encoder from the upstream
# tagged release; install the static libs + pkg-config file so FFmpeg's
# `--enable-libvvenc` configure probe succeeds. Pin to a tag known to
# compile against gcc-13 / cmake>=3.13 on Ubuntu 24.04.
#
# Build options:
#   -DBUILD_SHARED_LIBS=ON   exposes libvvenc.so so we don't statically link
#                            into ffmpeg (smaller binary; matches the other
#                            codec deps' .so layout).
#   -DVVENC_ENABLE_INSTALL=ON installs pkg-config (libvvenc.pc) so FFmpeg's
#                            check_pkg_config probe matches.
#   -DCMAKE_BUILD_TYPE=Release optimised encoder; debug builds are 5-10x slower.
#
# Threading: GitHub raw artifacts are subject to rate limiting; clone via
# the upstream Fraunhofer mirror which has higher bandwidth caps.
# 1.14.0 adds encoder quality improvements at medium presets and gcc-14
# compatibility fixes. API-stable within the 1.x line.
# Bumped from 1.12.0 per ADR-0568 (SDK audit 2026-05-18).
ARG VVENC_VERSION=1.14.0
RUN --mount=type=cache,target=/root/.cache/ccache,sharing=locked,id=ccache-dev-mcp \
    CCACHE_DIR=/root/.cache/ccache \
    git clone --depth=1 --branch "v${VVENC_VERSION}" \
        https://github.com/fraunhoferhhi/vvenc.git /tmp/vvenc \
    && cmake -S /tmp/vvenc -B /tmp/vvenc/build \
        -DCMAKE_BUILD_TYPE=Release \
        -DCMAKE_INSTALL_PREFIX=/usr/local \
        -DCMAKE_C_COMPILER_LAUNCHER=ccache \
        -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
        -DBUILD_SHARED_LIBS=ON \
        -DVVENC_ENABLE_INSTALL=ON \
    && cmake --build /tmp/vvenc/build -j"$(nproc)" \
    && cmake --install /tmp/vvenc/build \
    && ldconfig \
    && rm -rf /tmp/vvenc

# ---- AMD AMF headers (Advanced Media Framework, header-only) ---------------
# AMF is a header-only API; the actual encoder runs inside the AMD GPU
# user-space driver (amdgpu-pro). FFmpeg's `--enable-amf` only needs the
# headers at build time. Vendored from the upstream GPUOpen repo.
#
# Runtime requirement (not covered by this layer):
#   `libamfrt64.so` from amdgpu-pro userspace. On hosts without amdgpu-pro,
#   `h264_amf` / `hevc_amf` / `av1_amf` will probe-fail at runtime ("encoder
#   compiled in, dlopen libamfrt64.so failed"). vmaf-tune's probe handles
#   that case as a per-encoder skip — see ADR-0541 §Consequences.
# FFmpeg n9.0.2's configure probe is
# `AMF_VERSION >= 0x0001000400240000` (= 1.4.36); older AMF tags hard-error
# with `ERROR: amf requested but not found`. v1.4.36 is the minimum compatible
# tag (verified 2026-09-20 against the n9.0.2 configure source).
# 1.5.2 satisfies the >=1.4.36 probe. `--disable-filter=amf_capture` in the
# FFmpeg configure already neutralises the DisplayCapture.h C++ header change
# in 1.5.x. Bumped from 1.4.36 per ADR-0568 (SDK audit 2026-05-18).
ARG AMF_VERSION=1.5.3
RUN /build/vmaf/scripts/ci/checkout-annotated-tag.sh \
        https://github.com/GPUOpen-LibrariesAndSDKs/AMF.git "v${AMF_VERSION}" /tmp/AMF \
    && mkdir -p /usr/local/include/AMF \
    && cp -r /tmp/AMF/amf/public/include/* /usr/local/include/AMF/ \
    && rm -rf /tmp/AMF

USER vmaf

# ---------------------------------------------------------------------------
# ffmpeg-compile: the FFmpeg checkout and objects exist only in this stage.
# ---------------------------------------------------------------------------
FROM codec-deps AS ffmpeg-compile
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
WORKDIR /build/vmaf
USER vmaf

ARG FFMPEG_TAG=n9.0.2
ARG FFMPEG_REMOTE=https://github.com/FFmpeg/FFmpeg.git
RUN /build/vmaf/scripts/ci/checkout-annotated-tag.sh \
        "${FFMPEG_REMOTE}" "${FFMPEG_TAG}" /build/ffmpeg
WORKDIR /build/ffmpeg

# The shared FFmpeg fix series first (ADR-3143; verified against
# build-config.env by the script), then ffmpeg-patches/series.txt in order.
# /build/vmaf holds no build-config.env in this stage; the gpu-sdks stage
# copied the file to /opt/vmafx.
RUN FFMPEG_FIX_SERIES_CACHE=none BUILD_CONFIG=/opt/vmafx/build-config.env \
    bash /build/vmaf/scripts/ci/ffmpeg-shared-series.sh apply --method am /build/ffmpeg
RUN git config user.email "vmaf-dev-mcp@localhost" && git config user.name "vmaf dev-mcp" && while IFS= read -r patch_name; do \
        case "${patch_name}" in \
            ""|"#"*) continue ;; \
        esac ; \
        echo "applying ffmpeg-patches/${patch_name}" ; \
        git am --3way "/build/vmaf/ffmpeg-patches/${patch_name}" \
            || { echo "FATAL: ffmpeg-patches/${patch_name} did not apply"; git am --abort 2>/dev/null || true; exit 1; } ; \
    done < /build/vmaf/ffmpeg-patches/series.txt

# FFmpeg configure with the fork's full encoder matrix.
#
# Codec-by-codec rationale (see ADR-0541):
#
#   Software AV1:
#     --enable-libsvtav1   SVT-AV1 (Intel/Netflix, the production
#                          software AV1 encoder).
#     `--enable-libaom` is intentionally NOT passed — shared fix series
#     patch 0043 needs libaom >= 3.13.0 for its ROI fields (v3.12.1 and older
#     lack them). The dev container base ships 3.13.1 (has the fields), but
#     libaom is omitted until a separate build change adds libaom-dev and
#     `--enable-libaom` and a patch-stack build proves it. The node builder base
#     (Debian 13) ships 3.12.1 (lacks the fields). SVT-AV1 covers the AV1
#     production lane. See the comment block on the libaom skip above.
#
#   Software VVC (H.266):
#     --enable-libvvenc    Fraunhofer reference VVC encoder
#
#   NVIDIA hardware (RTX 4090):
#     --enable-nvenc       h264_nvenc / hevc_nvenc / av1_nvenc
#     --enable-cuda-nvcc   Lets FFmpeg compile its own CUDA kernels (used by
#                          `scale_cuda`, `hwupload_cuda` etc. that the GPU
#                          encode pipelines lean on). Requires CUDA_HOME.
#
#   `--enable-libnpp` is INTENTIONALLY OMITTED. FFmpeg n9.0.2 has
#   removed libnpp support; it retains the option only as a compatibility
#   no-op and emits `libnpp has been removed and enabling it does nothing`.
#   Passing it would therefore add no filter and would make a warning-clean
#   configure impossible. `scale_cuda` (built via `--enable-cuda-nvcc`)
#   covers the usual hwupload → scale → nvenc GPU pipeline. Re-add the
#   option only if a future FFmpeg release restores a real libnpp probe and
#   the image validates the matching CUDA contract.
#
#   Intel hardware (Arc / Xe / Gen11+):
#     --enable-libvpl      Intel oneVPL — the modern unified API that
#                          replaced legacy libmfx. Provides
#                          `h264_qsv` / `hevc_qsv` / `av1_qsv` /
#                          `vp9_qsv` / `mjpeg_qsv` encoders. The
#                          legacy `--enable-libmfx` is intentionally
#                          omitted (sunsetted by Intel for Arc;
#                          oneVPL is the supported successor on
#                          Gen11+ silicon including the host's A380).
#
#   AMD hardware (gfx1036 + future Radeon):
#     --enable-amf         h264_amf / hevc_amf / av1_amf. AMF is a
#                          header-only API at FFmpeg build time;
#                          libamfrt64.so dlopen happens at runtime
#                          and requires the amdgpu-pro userspace.
#     --disable-filter=amf_capture
#                          The `amf_capture` (`vsrc_amf.c`, AMF Display
#                          Capture source filter) includes AMF's
#                          `components/DisplayCapture.h` which contains
#                          `extern "C"` blocks. FFmpeg compiles
#                          `vsrc_amf.c` as plain C and chokes on the
#                          C++ syntax (verified 2026-05-18 against AMF
#                          v1.4.36 / FFmpeg n9.0.2). The filter is for
#                          screen-capture sources we don't use; the
#                          `*_amf` encoders live in separate
#                          translation units (`libavcodec/amfenc*.c`)
#                          and are unaffected. Filter name is taken
#                          from `OBJS-$(CONFIG_AMF_CAPTURE_FILTER)`
#                          in `libavfilter/Makefile`.
#
# vmafx integration patches:
#     --enable-libvmafx — fork patches.
# PKG_CONFIG_PATH must explicitly include /usr/lib/x86_64-linux-gnu/pkgconfig
# (the Ubuntu/Debian multiarch path) so FFmpeg's `check_pkg_config` probes
# pick up the distro-installed `.pc` files — `SvtAv1Enc.pc` (from
# `libsvtav1-dev`), `aom.pc` (from `libaom-dev`), `vpl.pc` (from `libvpl-dev`).
# The default pkg-config search path varies by distro/version: on some
# builds setting PKG_CONFIG_PATH only *prepends*, but ffmpeg's configure
# also passes it through to its own pkg-config invocations which lose the
# implicit defaults. Listing the multiarch path explicitly is the
# robust fix (verified post-ADR-0541 SvtAv1Enc-not-found regression).
# The warning gate here covers the files this fork patches, not all of FFmpeg.
# The CI workflow legs build a focused FFmpeg and are held to zero warnings
# outright; this image is a development container with --enable-gpl
# --enable-nonfree and some twenty external libraries, so it compiles far more
# upstream code, against whatever GCC the base image happens to ship. Holding
# all of that warning-free is not a line this fork can keep: measured
# 2026-09-23, FFmpeg n9.0.2 emits three -Wstringop-overflow warnings in
# libavcodec/wmalosslessdec.c under GCC 15 (reproduced in a gcc:15 container)
# and none under GCC 16, and the bound GCC cannot see there IS validated in
# decode_init. A gate that fails on upstream's own diagnostics under one
# distro's compiler is a gate that fails for reasons nobody here can fix.
#
# What the fork patches, it owns. The list is derived from the applied series
# rather than hand-maintained, so a new patch widens the gate automatically,
# and an empty list is a hard failure rather than a silent pass.
RUN --mount=type=cache,target=/home/vmaf/.cache/ccache,sharing=locked,uid=2000,gid=2000,id=ccache-dev-mcp-vmaf \
    CCACHE_DIR=/home/vmaf/.cache/ccache \
    PKG_CONFIG_PATH=/usr/local/lib/pkgconfig:/usr/local/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig \
    ./configure \
        --fatal-warnings \
        --prefix=/usr/local \
        --enable-gpl --enable-version3 --enable-nonfree \
        --enable-libvmafx \
        --enable-libx264 --enable-libx265 \
        --enable-libvpx --enable-libdav1d \
        --enable-libsvtav1 --enable-libvvenc \
        --enable-libfdk-aac --enable-libmp3lame --enable-libopus --enable-libvorbis \
        --enable-libass --enable-libfreetype --enable-libfontconfig --enable-libfribidi \
        --enable-vaapi --enable-vdpau --enable-libdrm \
        --enable-nvenc --enable-cuda-nvcc \
        --enable-libvpl \
        --enable-amf \
        --disable-filter=amf_capture \
        --cc='ccache gcc' \
        --cxx='ccache g++' \
        --extra-cflags="-I${CUDA_HOME}/include -I/usr/local/include" \
        --extra-ldflags="-L${CUDA_HOME}/lib64 -L/usr/local/lib" \
    && make -j"$(nproc)" 2>&1 | tee /tmp/ffmpeg-build.log \
    && awk '/^\+\+\+ b\//{sub(/^\+\+\+ b\//,""); print}' \
        /build/vmaf/ffmpeg-patches/*.patch | sort -u > /tmp/ffmpeg-patched-files.txt \
    && if [ ! -s /tmp/ffmpeg-patched-files.txt ]; then \
        echo "FATAL: derived no patched-file list; the warning gate would pass vacuously" >&2; \
        exit 1; \
    fi \
    && echo "warning gate covers $(wc -l < /tmp/ffmpeg-patched-files.txt) fork-patched file(s)" \
    && if grep -Ei '(^|[[:space:]])warning([[:space:]#:])' /tmp/ffmpeg-build.log \
        | grep -Ff /tmp/ffmpeg-patched-files.txt; then \
        echo "FATAL: a file this fork patches emitted compiler warnings" >&2; \
        exit 1; \
    fi \
    && rm /tmp/ffmpeg-build.log /tmp/ffmpeg-patched-files.txt

USER root
# Install into a staging root; libvmaf-build copies only that root.
WORKDIR /build/vmaf
RUN make -C /build/ffmpeg install DESTDIR=/stage/ffmpeg

# ---------------------------------------------------------------------------
# libvmaf-build: codec-deps plus the installed FFmpeg.
# ---------------------------------------------------------------------------
FROM codec-deps AS libvmaf-build
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
WORKDIR /build/vmaf
USER root
COPY --from=ffmpeg-compile /stage/ffmpeg/ /
RUN ldconfig \
    && /usr/local/bin/ffmpeg -version | head -3

# ---- Build-time encoder probe (ADR-0541) ----------------------------------
# Walk every encoder this stage promises and grep the actual `ffmpeg
# -encoders` output for it. Listing a compiled encoder does not require its
# hardware device, so a missing promised encoder is a build failure rather
# than a warning. This catches configure drift before a user runs a sweep.
#
# Mirrors the libvmaf backend probe at stage 3.
RUN echo "=== ffmpeg encoder probe (ADR-0541) ===" \
    && missing=0 \
    && for enc in libx264 libx265 libvpx-vp9 libsvtav1 libvvenc \
                  h264_nvenc hevc_nvenc av1_nvenc \
                  h264_qsv hevc_qsv av1_qsv \
                  h264_amf hevc_amf av1_amf ; do \
         if /usr/local/bin/ffmpeg -hide_banner -encoders 2>/dev/null \
             | awk -v e="$enc" '{ if ($2 == e) { print; found=1 } } END { exit !found }' ; then \
           printf "  ok   %s\n" "$enc" ; \
         else \
           printf "  FATAL %s missing from ffmpeg -encoders\n" "$enc" >&2 ; \
           missing=1 ; \
         fi ; \
       done \
    && test "$missing" -eq 0
USER vmaf

WORKDIR /build/vmaf

# ---------------------------------------------------------------------------
# Stage 4 — Python environment
# ---------------------------------------------------------------------------
# =============================================================================
# Go builder — compiles the seven vmafx binaries (ADR-0702 Phase 4).
#
# Until now the image shipped ZERO Go binaries and had no Go toolchain at all,
# so `vmafx-server`, `vmafx-mcp`, `vmafx-tune`, `vmafx-controller`, `vmafx-node`
# and `vmafx-operator` existed only on a developer's host. That makes
# CLAUDE.md §15 ("default to the container for vmaf / vmaf-tune / ai / MCP
# work") impossible to satisfy for any Go surface, and it blocks the Python
# sunset in ADR-0703 §Decision / ADR-0704 §Consequences — the Python cannot be
# removed from the image before the Go replacements are in it.
#
# This stage derives from libvmaf-build rather than a bare `golang` image
# because five of the seven binaries link libvmaf through cgo (pkg/libvmaf):
# vmafx-server, vmafx-mcp, vmafx-controller and vmafx-node all fail to build
# under CGO_ENABLED=0 with "undefined: libvmaf.Scorer", and vmafx-ort-runner
# (ADR-1134) is a cgo shim over libvmaf's ONNX session API that the pure-Go
# vmafx-tune execs for its `--model` predictors. Only vmafx-tune and
# vmafx-operator are pure Go. So the toolchain is copied INTO the stage that
# already has libvmaf.so and its headers, rather than the other way round.
# =============================================================================
# Go toolchain as a named stage: the pin stays an ordinary FROM the
# single-source gate can see.
FROM ${DEV_GO_BASE} AS go-toolchain

FROM libvmaf-build AS go-build

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
USER root
# Toolchain only — no base-image swap, so libvmaf and its pkg-config stay put.
COPY --from=go-toolchain /usr/local/go /usr/local/go
ENV PATH=/usr/local/go/bin:${PATH}
ENV GOTOOLCHAIN=local

WORKDIR /build/vmaf
# The libvmaf-build stage intentionally copies only its C/Python build inputs.
# Copy the Go module and every repository-local package imported by ./cmd/...
# here so this stage remains cacheable without bloating the earlier image.
COPY go.mod go.sum build-config.env ./
COPY cmd/ ./cmd/
COPY pkg/ ./pkg/
COPY api/ ./api/
COPY gen/ ./gen/
COPY internal/ ./internal/
# vmafx-node embeds an eBPF object that is not committed (ADR-1622): generate it
# with the pinned clang before the build; --require-pin fails on any other clang.
COPY scripts/dev/gen-node-bpf.sh ./scripts/dev/gen-node-bpf.sh
RUN ./scripts/dev/gen-node-bpf.sh --require-pin
# cgo needs to find libvmaf.so and libvmaf.h from the libvmaf-build stage.
ENV CGO_ENABLED=1
RUN --mount=type=cache,target=/root/.cache/go-build,sharing=locked,id=gobuild-dev-mcp \
    --mount=type=cache,target=/root/go/pkg/mod,sharing=locked,id=gomod-dev-mcp \
    CGO_LDFLAGS="-L/usr/local/lib -lvmaf -lvmafx -lm" \
    go build -trimpath -ldflags="-s -w" -o /out/ ./cmd/... \
    && binaries=(/out/*) \
    && printf '%s\n' "${binaries[@]}" \
    && test "${#binaries[@]}" -eq 7 \
    && test -x /out/vmafx-ort-runner
USER vmaf

FROM libvmaf-build AS dev-mcp

SHELL ["/bin/bash", "-o", "pipefail", "-c"]
# The hash-locked installs below read requirements/locks/*.txt. Copied here,
# not with the libvmaf-build subtrees, so lock changes do not invalidate the
# libvmaf and FFmpeg build layers.
COPY --chown=vmaf:vmaf requirements/ /build/vmaf/requirements/
# Install in-tree Python packages (editable for dev convenience)
# vmaf-mcp: embedded MCP JSON-RPC server
# vmaf-train: tiny-AI training harness (ai/)
# vmaf-tune: encode automation / VMAF-tune CLI
USER root
# matplotlib: vmaf-tune report renderer (charts in the markdown/html
# bundles). ADR-0496 demands every user-discoverable surface work
# inside the container; BBB e2e v2 Bug #v2-C surfaced when ``report``
# crashed on ``ModuleNotFoundError: matplotlib`` because the package
# wasn't baked in. ADR-0498 closes the gap.
RUN python3.14 -m venv /opt/vmaf-venv \
    && /opt/vmaf-venv/bin/pip install --no-cache-dir --require-hashes \
        -r /build/vmaf/requirements/locks/package-build.txt \
    && /opt/vmaf-venv/bin/pip install --no-cache-dir --no-build-isolation --require-hashes \
        -r /build/vmaf/dev/requirements-python-env-lock.txt \
    # The Python harness (`python/pyproject.toml`, package name `vmaf`,
    # re-exporting compat/python-vmaf per ADR-0700). The layout comment at the
    # top of this stage has always described it as "pip-installed via the
    # python/ shim", and the Netflix golden YUV fetch above exists, in its own
    # words, "so that `pytest python/test/` passes inside the container" -- but
    # nothing ever installed it, so that command died at import with
    # `ModuleNotFoundError: No module named 'slugify'` and the fixture fetch
    # served no reachable purpose. Installed FIRST among the editable packages
    # so that the ai/ and vmaf-tune pins below are resolved last and win on any
    # shared dependency (numpy in particular).
    && /opt/vmaf-venv/bin/pip install --no-cache-dir --no-deps --no-build-isolation \
        -e /build/vmaf/python \
    && /opt/vmaf-venv/bin/pip install --no-cache-dir --no-deps --no-build-isolation \
        -e /build/vmaf/ai \
    && /opt/vmaf-venv/bin/pip install --no-cache-dir --no-deps --no-build-isolation \
        -e /build/vmaf/tools/vmaf-tune

# The seven Go binaries from the go-build stage (ADR-0702), on PATH beside the
# C `vmaf` CLI at /usr/local/bin/vmaf.
COPY --from=go-build /out/ /usr/local/bin/

# ADR-1134: vmafx-ort-runner must run a real forward pass in this image. Its
# libvmaf links ONNX Runtime (-Denable_dnn=enabled above), so a runner that
# only reports "DNN unavailable" means go-build linked the wrong libvmaf. The
# expected value is onnxruntime's CPU-EP answer for this row — see
# cmd/vmafx-ort-runner/main_test.go (predictorReference).
RUN vmafx-ort-runner --model /build/vmaf/model/predictor_libx264.onnx \
        --inputs '[51,1,1,1,1,0,0,0,0,0,1,1,16,16]' \
    | grep -Eq '^\[66\.1[0-9]+\]$'

# Which source this image was actually built from (ADR-1195).
#
# The ADR-1102 marker above says "a container built this"; it cannot say WHICH
# code. That gap is not theoretical: on 2026-09-06 the container was rebuilt to
# pick up the GPU default-model fixes, the build context was 28 commits behind
# master, and the image contained none of them while looking perfectly fresh by
# timestamp. Anything measured inside such an image is confidently wrong.
#
# Deliberately in the LAST stage. In the first stage it would sit in a layer
# that every rebuild reuses, so it would record the revision of whichever build
# first populated the cache rather than this one.
#
# VMAFX_SOURCE_REV is supplied by dev/docker-compose.yml. A build that does not
# pass it records `unknown`, and scripts/dev/check-container-source.sh treats
# `unknown` as "cannot verify" rather than as a pass.
ARG VMAFX_SOURCE_REV=unknown
ARG VMAFX_SOURCE_REF=unknown
RUN printf '%s\n' \
    "source_rev=${VMAFX_SOURCE_REV}" \
    "source_ref=${VMAFX_SOURCE_REF}" \
    'source_repo=https://github.com/VMAFx/vmafx' \
    > /etc/vmafx-dev-source \
    && chmod 0644 /etc/vmafx-dev-source
# The Python harness must be importable, and the Netflix golden suite must
# collect. Asserted at build time because the failure mode is silent: the YUV
# fixtures above are fetched specifically to make `pytest python/test/` work,
# and for a long time it could not run at all while the build stayed green.
# `--collect-only` keeps this to an import + collection check (seconds); the
# suite itself is a CI gate, not a container build step.
# Explicit interpreter path: `ENV PATH=/opt/vmaf-venv/bin:...` is set BELOW
# this line, so a bare `python3` here would be the system interpreter, which
# does not have the harness installed.
RUN /opt/vmaf-venv/bin/python -c 'import vmaf, slugify; print("harness import OK:", vmaf.__file__)' \
    && if /opt/vmaf-venv/bin/python -m pytest python/test/quality_runner_test.py --collect-only -q \
        > /tmp/collect.log 2>&1; then \
         tail -n 1 /tmp/collect.log; \
       else \
         echo "Netflix golden suite does not collect inside the container:"; \
         tail -n 20 /tmp/collect.log; exit 1; \
       fi

ENV PATH=/opt/vmaf-venv/bin:${PATH}
ENV PYTHONPATH=/build/vmaf/python

# Runtime environment
ENV VMAF_MODEL_PATH=/build/vmaf/model
ENV VMAF_TESTDATA_PATH=/build/vmaf/testdata
# MCP UDS socket path (must match dev-mcp-entrypoint.sh and docker-compose.yml)
ENV VMAF_MCP_UDS_PATH=/tmp/vmaf-mcp.sock
# ADR-0546: route vmaf-tune temporary decode artefacts to the /probes
# bind-mount (~435 GB free in production) instead of the 8 GB /tmp tmpfs.
# The entrypoint creates /probes/vmaftune-work at startup.
ENV VMAFTUNE_WORKDIR=/probes/vmaftune-work

# Expose the SSE port (if SSE transport is enabled at build time)
EXPOSE 8765

# Health-check: verify libvmaf is installed and returns version
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
    CMD vmaf --version || exit 1

# Drop back to vmaf user for runtime (USER root was needed only for
# the pip-install RUN above).
USER vmaf

ENTRYPOINT ["/build/vmaf/dev/scripts/dev-mcp-entrypoint.sh"]
CMD []