build(docker): slim backend image, static frontend image, -docling variant

Backend (arc53/docsgpt): 4.5 GB compressed -> 0.9 GB with both embedding
models and tiktoken baked in.
- torch/transformers gone from the default install (docling extra only).
- Ubuntu 24.04 ships python3.12: no deadsnakes PPA, no software-properties-
  common; every pin is a wheel, so no gcc/g++/rust in the builder.
- COPY --chown and a prefetch that runs as the process user replace the
  trailing chown -R, which duplicated the 600 MB model layer.
- .dockerignore keeps __pycache__, .coverage, local indexes and .env out.
- EXTRAS build arg (INSTALL_DOCLING kept as an alias); the docling variant
  also bakes docling's layout/table/RapidOCR models (DOCLING_ARTIFACTS_PATH)
  and tesseract, and drops only the discovery documents of Google APIs the
  app never builds.
- FLASK_DEBUG env removed (unused); OCI labels added.

Frontend (arc53/docsgpt-fe): 302 MB Vite dev server -> 25 MB static build
behind nginx. VITE_* variables are injected at container start into
/config.js and read through src/env.ts, so the image no longer needs a
rebuild per deployment; docker-compose.yaml keeps hot reload via the dev
target.

Publishing: every release and develop build now pushes a slim tag and a
-docling tag (docling engine + models + tesseract). docker-compose-hub.yaml
takes DOCSGPT_IMAGE_TAG / DOCSGPT_IMAGE_VARIANT; docker-compose-standalone.yaml
runs the stack from pre-built images without a checkout and is attached to
each release. setup.sh selects the -docling variant for OCR instead of
requiring a local build. A new workflow builds the image on PRs that touch
it and runs verify_offline under --network none; lint checks the exported
requirements match uv.lock.

.github/workflows/ci.yml

@@ -9,24 +9,17 @@ jobs:
     if: github.repository == 'arc53/DocsGPT'
     strategy:
       matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            suffix: amd64
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            suffix: arm64
-    runs-on: ${{ matrix.runner }}
+        platform: [linux/amd64, linux/arm64]
+        # "" is the slim default image; "-docling" bakes the docling parser
+        # engine, its models and tesseract in (OCR-ready).
+        variant: ["", "-docling"]
+    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up QEMU  # Only needed for emulation, not for native arm64 builds
-        if: matrix.platform == 'linux/arm64'
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
@@ -46,6 +39,17 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Image metadata (OCI labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKER_USERNAME }}/docsgpt
+            ghcr.io/${{ github.repository_owner }}/docsgpt
+          labels: |
+            org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
+            org.opencontainers.image.version=${{ github.event.release.tag_name }}
+
       - name: Build and push platform-specific images
         uses: docker/build-push-action@v6
         with:
@@ -53,17 +57,24 @@ jobs:
           platforms: ${{ matrix.platform }}
           context: ./application
           push: true
+          build-args: |
+            EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
+            INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
           tags: |
-            ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}-${{ matrix.suffix }}
-            ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}-${{ matrix.suffix }}
+            ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
+            ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
+          labels: ${{ steps.meta.outputs.labels }}
           provenance: false
           sbom: false
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:latest
+          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:latest${{ matrix.variant }}
           cache-to: type=inline
 
   manifest:
     if: github.repository == 'arc53/DocsGPT'
     needs: build
+    strategy:
+      matrix:
+        variant: ["", "-docling"]
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -87,26 +98,33 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Create and push manifest for DockerHub
+      - name: Create and push multi-arch manifests
+        env:
+          TAG: ${{ github.event.release.tag_name }}${{ matrix.variant }}
+          LATEST: latest${{ matrix.variant }}
         run: |
           set -e
-          docker manifest create ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }} \
-            --amend ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}-amd64 \
-            --amend ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}-arm64
-          docker manifest push ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}
-          docker manifest create ${{ secrets.DOCKER_USERNAME }}/docsgpt:latest \
-            --amend ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}-amd64 \
-            --amend ${{ secrets.DOCKER_USERNAME }}/docsgpt:${{ github.event.release.tag_name }}-arm64
-          docker manifest push ${{ secrets.DOCKER_USERNAME }}/docsgpt:latest
+          for repo in "${{ secrets.DOCKER_USERNAME }}/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
+            for name in "$TAG" "$LATEST"; do
+              docker manifest create "$repo:$name" \
+                --amend "$repo:$TAG-amd64" \
+                --amend "$repo:$TAG-arm64"
+              docker manifest push "$repo:$name"
+            done
+          done
 
-      - name: Create and push manifest for ghcr.io
+  release-assets:
+    if: github.repository == 'arc53/DocsGPT'
+    needs: manifest
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Attach the standalone compose file to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          set -e
-          docker manifest create ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }} \
-            --amend ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}-amd64 \
-            --amend ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}-arm64
-          docker manifest push ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}
-          docker manifest create ghcr.io/${{ github.repository_owner }}/docsgpt:latest \
-            --amend ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}-amd64 \
-            --amend ghcr.io/${{ github.repository_owner }}/docsgpt:${{ github.event.release.tag_name }}-arm64
-          docker manifest push ghcr.io/${{ github.repository_owner }}/docsgpt:latest
+          gh release upload "${{ github.event.release.tag_name }}" \
+            deployment/docker-compose-standalone.yaml --clobber

.github/workflows/docker-develop-build.yml

@@ -11,14 +11,11 @@ jobs:
     if: github.repository == 'arc53/DocsGPT'
     strategy:
       matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-latest
-            suffix: amd64
-          - platform: linux/arm64
-            runner: ubuntu-24.04-arm
-            suffix: arm64
-    runs-on: ${{ matrix.runner }}
+        platform: [linux/amd64, linux/arm64]
+        # "" is the slim default image; "-docling" bakes the docling parser
+        # engine, its models and tesseract in (OCR-ready).
+        variant: ["", "-docling"]
+    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
     permissions:
       contents: read
       packages: write
@@ -36,7 +33,7 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      
+
       - name: Login to ghcr.io
         uses: docker/login-action@v3
         with:
@@ -44,6 +41,17 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Image metadata (OCI labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKER_USERNAME }}/docsgpt
+            ghcr.io/${{ github.repository_owner }}/docsgpt
+          labels: |
+            org.opencontainers.image.title=DocsGPT${{ matrix.variant }}
+            org.opencontainers.image.version=develop
+
       - name: Build and push platform-specific images
         uses: docker/build-push-action@v6
         with:
@@ -51,17 +59,24 @@ jobs:
           platforms: ${{ matrix.platform }}
           context: ./application
           push: true
+          build-args: |
+            EXTRAS=${{ matrix.variant == '-docling' && 'docling' || '' }}
+            INSTALL_TESSERACT=${{ matrix.variant == '-docling' && 'true' || 'false' }}
           tags: |
-            ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop-${{ matrix.suffix }}
-            ghcr.io/${{ github.repository_owner }}/docsgpt:develop-${{ matrix.suffix }}
+            ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
+            ghcr.io/${{ github.repository_owner }}/docsgpt:develop${{ matrix.variant }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
+          labels: ${{ steps.meta.outputs.labels }}
           provenance: false
           sbom: false
-          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:develop
+          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/docsgpt:develop${{ matrix.variant }}
           cache-to: type=inline
 
   manifest:
     if: github.repository == 'arc53/DocsGPT'
     needs: build
+    strategy:
+      matrix:
+        variant: ["", "-docling"]
     runs-on: ubuntu-latest
     permissions:
       packages: write
@@ -77,24 +92,22 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      
+
       - name: Login to ghcr.io
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-        
-      - name: Create and push manifest for DockerHub
-        run: |
-          docker manifest create ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop \
-            --amend ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop-amd64 \
-            --amend ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop-arm64
-          docker manifest push ${{ secrets.DOCKER_USERNAME }}/docsgpt:develop
 
-      - name: Create and push manifest for ghcr.io
+      - name: Create and push multi-arch manifests
+        env:
+          TAG: develop${{ matrix.variant }}
         run: |
-          docker manifest create ghcr.io/${{ github.repository_owner }}/docsgpt:develop \
-            --amend ghcr.io/${{ github.repository_owner }}/docsgpt:develop-amd64 \
-            --amend ghcr.io/${{ github.repository_owner }}/docsgpt:develop-arm64
-          docker manifest push ghcr.io/${{ github.repository_owner }}/docsgpt:develop
+          set -e
+          for repo in "${{ secrets.DOCKER_USERNAME }}/docsgpt" "ghcr.io/${{ github.repository_owner }}/docsgpt"; do
+            docker manifest create "$repo:$TAG" \
+              --amend "$repo:$TAG-amd64" \
+              --amend "$repo:$TAG-arm64"
+            docker manifest push "$repo:$TAG"
+          done

.github/workflows/docker-image-verify.yml

@@ -0,0 +1,52 @@
+name: Verify the Docker image works offline
+
+# Builds the backend image and runs its offline check with networking off, so
+# a change that reintroduces a first-request download (a tokenizer, tiktoken's
+# encoding, an embedding model) fails here instead of in an air-gapped install.
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'application/Dockerfile'
+      - 'application/.dockerignore'
+      - 'application/requirements*.txt'
+      - 'application/scripts/prefetch_models.py'
+      - 'application/scripts/verify_offline.py'
+      - 'application/vectorstore/model_registry.py'
+      - 'application/parser/tokenization.py'
+      - 'application/vectorstore/embeddings_local.py'
+      - '.github/workflows/docker-image-verify.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build the slim image
+        uses: docker/build-push-action@v6
+        with:
+          file: ./application/Dockerfile
+          context: ./application
+          platforms: linux/amd64
+          load: true
+          tags: docsgpt:verify
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Image size
+        run: |
+          docker image inspect docsgpt:verify --format '{{.Size}}' | awk '{printf "uncompressed: %.2f GB\n", $1/1e9}'
+          docker history docsgpt:verify --format '{{.Size}}\t{{.CreatedBy}}' | head -20
+
+      - name: Offline verification (no network)
+        run: |
+          docker run --rm --network none docsgpt:verify \
+            python -m application.scripts.verify_offline

.github/workflows/lint.yml

@@ -20,3 +20,18 @@ jobs:
         uses: chartboost/ruff-action@v1
         with:
           version: 0.14.10
+
+  requirements-in-sync:
+    # application/requirements*.txt are exported from uv.lock; fail when a
+    # change to pyproject.toml or uv.lock was not re-exported.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v6
+
+      - name: Re-export and diff
+        run: |
+          uv lock --check
+          bash scripts/export_requirements.sh
+          git diff --exit-code -- application/requirements.txt application/requirements-docling.txt application/requirements-milvus.txt