Multi-stage Containerfile modeled on cang: locked deps via
uv sync --frozen --no-dev --no-install-project into /app/.venv,
source tree + alembic migrations at /app (init_db resolves
alembic.ini against the source root), non-root system user,
/data volume for the SQLite db and media directory.

One image, two entry points via docker-entrypoint.sh:
- web: waitress (new runtime dep, ~=3.0.2) on $PORT (default 8080)
- worker: init once, then fetch -> aggregate -> extract-tags every
  $YUNJIN_WORKER_INTERVAL seconds; task failures are logged, not fatal

waitress is excluded from deptry DEP002: invoked by the entrypoint,
never imported.

@@ -58,2 +60,4 @@
           uv run nox
           uv build
+
+  container:

@@ -60,0 +65,4 @@
+    timeout-minutes: 30
+    if: github.event_name != 'release'
+    steps:
+      - uses: actions/checkout@v4

@@ -60,0 +97,4 @@
+      - name: Install buildah
+        run: apt-get update -qq && apt-get install -y -qq podman buildah
+      - name: Login to registry
+        run: buildah login --username "${{ secrets.registry_user }}" --password "${{ secrets.registry_password }}" registry.marvin8.zone

@@ -60,0 +118,4 @@
+            --annotation "org.opencontainers.image.url=https://forge.marvin8.zone/marvin8/yunjin" \
+            --annotation "org.opencontainers.image.revision=${REVISION}" \
+            --annotation "org.opencontainers.image.version=${VERSION}" \
+            -t registry.marvin8.zone/marvin8/yunjin:latest \

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder
+ARG UV_VERSION

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder
+ARG UV_VERSION
+COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /usr/local/bin/uv

@@ -0,0 +15,4 @@
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM python:3.12-slim-bookworm

@@ -0,0 +20,4 @@
+case "${1:-web}" in
+  web)
+    : "${PORT:=8080}"
+    exec waitress-serve --host=0.0.0.0 --port="${PORT}" yunjin.web.wsgi:app

@@ -0,0 +23,4 @@
+    exec waitress-serve --host=0.0.0.0 --port="${PORT}" yunjin.web.wsgi:app
+    ;;
+  worker)
+    : "${YUNJIN_WORKER_INTERVAL:=3600}"

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder
+ARG UV_VERSION=0.12.18
+COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /usr/local/bin/uv

@@ -0,0 +15,4 @@
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM python:3.12-slim-bookworm

@@ -0,0 +25,4 @@
+  worker)
+    : "${YUNJIN_WORKER_INTERVAL:=3600}"
+    case "$YUNJIN_WORKER_INTERVAL" in
+      ''|*[!0-9]*|0)

@@ -0,0 +35,4 @@
+    while :; do
+      for task in fetch aggregate extract-tags; do
+        echo "yunjin worker: running ${task}"
+        if ! python -m yunjin "${task}"; then

@@ -60,0 +66,4 @@
+    needs: [gitleaks, checks]
+    if: github.event_name != 'release'
+    steps:
+      - uses: actions/checkout@v4

@@ -60,0 +73,4 @@
+        env:
+          REVISION: ${{ github.sha }}
+        run: |
+          UV_VERSION=$(grep -oP '"uv~=\K[0-9]+\.[0-9]+\.[0-9]+' pyproject.toml)

@@ -60,0 +98,4 @@
+      - name: Install buildah
+        run: apt-get update -qq && apt-get install -y -qq podman buildah
+      - name: Login to registry
+        run: printf '%s' "${{ secrets.registry_password }}" | buildah login --username "${{ secrets.registry_user }}" --password-stdin registry.marvin8.zone

@@ -60,0 +111,4 @@
+            --build-arg REVISION="${REVISION}" \
+            --build-arg VERSION="${VERSION}" \
+            --build-arg UV_VERSION="${UV_VERSION}" \
+            --annotation "org.opencontainers.image.source=https://forge.marvin8.zone/marvin8/yunjin" \

@@ -0,0 +16,4 @@
+
+# Stop promptly on SIGTERM/SIGINT: kill the current background child (task
+# or sleep), since POSIX defers traps until the foreground wait returns.
+trap 'test -n "${child_pid:-}" && kill "$child_pid" 2>/dev/null; exit 0' TERM INT

@@ -0,0 +21,4 @@
+case "${1:-web}" in
+  web)
+    : "${PORT:=8080}"
+    exec waitress-serve --host=0.0.0.0 --port="${PORT}" yunjin.web.wsgi:app

@@ -0,0 +62,4 @@
+        child_pid=
+        python -m yunjin "${task}" &
+        child_pid=$!
+        if ! wait "$child_pid"; then

@@ -447,3 +447,3 @@
 [[packages]]
 name = "filelock"
-version = "3.32.6"
+version = "4.0.3"

@@ -1403,3 +1347,3 @@
 [[packages]]
 name = "sqlalchemy"
-version = "2.0.52"
+version = "2.1.0"

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder

@@ -0,0 +1,58 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder
+ARG UV_VERSION=0.12.18
+COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /usr/local/bin/uv

@@ -0,0 +15,4 @@
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM python:3.12-slim-bookworm

@@ -0,0 +17,4 @@
+
+FROM python:3.12-slim-bookworm
+
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin yunjin

@@ -0,0 +17,4 @@
+
+# Stop promptly on SIGTERM/SIGINT: kill the current background child (task
+# or sleep), since POSIX defers traps until the foreground wait returns.
+trap 'test -n "${child_pid:-}" && kill "$child_pid" 2>/dev/null; exit 0' TERM INT

@@ -0,0 +22,4 @@
+case "${1:-web}" in
+  web)
+    : "${PORT:=8080}"
+    exec waitress-serve --host=0.0.0.0 --port="${PORT}" yunjin.web.wsgi:app

@@ -0,0 +58,4 @@
+      exit 1
+    fi
+    while :; do
+      for task in fetch aggregate extract-tags extract-media; do

@@ -60,0 +66,4 @@
+    needs: [gitleaks, checks]
+    if: github.event_name != 'release'
+    steps:
+      - uses: actions/checkout@v4

@@ -60,0 +91,4 @@
+    needs: [gitleaks, checks]
+    if: github.event_name == 'release' && !github.event.release.prerelease
+    steps:
+      - uses: actions/checkout@v4

@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder

@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder
+ARG UV_VERSION=0.12.18
+COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /usr/local/bin/uv

@@ -0,0 +18,4 @@
+# Stop promptly on SIGTERM/SIGINT: kill the current background child (task
+# or sleep), since POSIX defers traps until the foreground wait returns, then
+# reap it before exiting so shutdown status reflects the child's termination.
+trap 'if [ -n "${child_pid:-}" ]; then kill "$child_pid" 2>/dev/null || :; wait "$child_pid" 2>/dev/null || :; fi; exit 0' TERM INT

@@ -0,0 +55,4 @@
+    # worker; retry briefly, then fail loudly on persistent errors.
+    init_ok=0
+    for attempt in 1 2 3; do
+      if python -m yunjin init; then

@@ -0,0 +15,4 @@
+COPY pyproject.toml uv.lock ./
+RUN uv sync --frozen --no-dev --no-install-project
+
+FROM python:3.12-slim-bookworm

@@ -0,0 +43,4 @@
+LABEL org.opencontainers.image.title="yunjin"
+LABEL org.opencontainers.image.url="https://forge.marvin8.zone/marvin8/yunjin"
+
+ARG REVISION

@@ -0,0 +20,4 @@
+# then reap it. Signal-driven shutdown deliberately reports success (the
+# conventional container stop status); interrupted work simply re-runs on
+# the next start.
+trap 'if [ -n "${child_pid:-}" ]; then kill "$child_pid" 2>/dev/null || :; wait "$child_pid" 2>/dev/null || :; fi; exit 0' TERM INT

@@ -0,0 +52,4 @@
+      echo "yunjin: invalid PORT: '${PORT}' (integer 1-65535 required)" >&2
+      exit 1
+    fi
+    exec waitress-serve --host=0.0.0.0 --port="${PORT}" yunjin.web.wsgi:app

@@ -0,0 +90,4 @@
+      echo "yunjin worker: sleeping ${YUNJIN_WORKER_INTERVAL}s"
+      sleep "${YUNJIN_WORKER_INTERVAL}" &
+      child_pid=$!
+      wait "$child_pid" || :

@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder

@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+FROM python:3.12-slim-bookworm AS builder
+ARG UV_VERSION=0.12.18
+COPY --from=ghcr.io/astral-sh/uv:${UV_VERSION} /uv /usr/local/bin/uv