Dockerfile

ARG RUST_IMAGE=rust:1.95.0-bookworm
ARG PYTHON_IMAGE=python:3.11.13-slim-bookworm
# Use the versioned archive: UCSC periodically replaces the unversioned binary.
ARG BEDGRAPH_TO_BIGWIG_URL=https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64.v479/bedGraphToBigWig
ARG BEDGRAPH_TO_BIGWIG_SHA256=22baf42aa4f01fa66a74a4d77afc6bbf5bc8354978aa2b7251a18ef9a1cc3c89

FROM ${RUST_IMAGE} AS gtg-builder

ARG GTG_COMMIT=e12aca6b49ee7208952467db4a2a9e2f79b98efb

RUN apt-get update \
    && apt-get install --yes --no-install-recommends \
        build-essential \
        ca-certificates \
        clang \
        cmake \
        git \
        libbz2-dev \
        libclang-dev \
        libcurl4-openssl-dev \
        liblzma-dev \
        libssl-dev \
        zlib1g-dev \
    && rm -rf /var/lib/apt/lists/*

RUN git clone --filter=blob:none \
        https://github.com/Platinum-Pedigree-Consortium/Platinum-Pedigree-Inheritance.git \
        /build/gtg \
    && git -C /build/gtg checkout --detach "${GTG_COMMIT}"

COPY containers/gtg.Cargo.lock /build/gtg/code/rust/Cargo.lock

RUN cargo build \
      --manifest-path /build/gtg/code/rust/Cargo.toml \
      --locked \
      --release \
      --bin gtg-ped-map \
      --bin gtg-concordance


FROM ${PYTHON_IMAGE} AS python-deps-builder

RUN apt-get update \
    && apt-get install --yes --no-install-recommends \
        autoconf \
        automake \
        build-essential \
        libbz2-dev \
        libcurl4-openssl-dev \
        liblzma-dev \
        libssl-dev \
        pkg-config \
        zlib1g-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements-pipeline.txt /opt/tapestry/requirements-pipeline.txt

# The PyPI wheels for pysam and cyvcf2 bundle Red Hat-patched OpenSSL
# libraries that abort when an Apptainer container runs on a FIPS-enabled
# host. Build just these two packages from source so their bundled HTSlib
# implementations use the base image's system libraries instead.
ENV CYVCF2_HTSLIB_MODE=BUILTIN \
    PIP_DEFAULT_TIMEOUT=30 \
    PIP_RETRIES=5
RUN python -m pip wheel \
      --wheel-dir /opt/tapestry/wheels \
      --no-binary=pysam,cyvcf2 \
      --requirement /opt/tapestry/requirements-pipeline.txt


FROM ${PYTHON_IMAGE} AS python-deps-installer

COPY requirements-pipeline.txt /opt/tapestry/requirements-pipeline.txt
COPY --from=python-deps-builder /opt/tapestry/wheels /opt/tapestry/wheels
RUN python -m pip install \
      --no-cache-dir \
      --no-index \
      --find-links=/opt/tapestry/wheels \
      --target=/opt/tapestry/site-packages \
      --requirement /opt/tapestry/requirements-pipeline.txt \
    && rm -rf /opt/tapestry/wheels


FROM ${PYTHON_IMAGE} AS runtime

ARG GTG_COMMIT=e12aca6b49ee7208952467db4a2a9e2f79b98efb
ARG BEDGRAPH_TO_BIGWIG_URL
ARG BEDGRAPH_TO_BIGWIG_SHA256
LABEL org.opencontainers.image.source="https://github.com/quinlan-lab/tapestry"
LABEL org.opencontainers.image.description="Tapestry generic pedigree/model-only runtime"
LABEL org.opencontainers.image.licenses="MIT"
LABEL org.opencontainers.image.gtg.commit="${GTG_COMMIT}"
LABEL org.opencontainers.image.ucsc-bedGraphToBigWig.sha256="${BEDGRAPH_TO_BIGWIG_SHA256}"

RUN apt-get update \
    && apt-get install --yes --no-install-recommends \
        bcftools \
        ca-certificates \
        curl \
        libbz2-1.0 \
        libcurl4 \
        liblzma5 \
        libssl3 \
        procps \
        tabix \
        zlib1g \
    && rm -rf /var/lib/apt/lists/*

# Retain the legacy UCSC generator as a pinned parity oracle for the pyBigWig
# migration test. Production BigWigs are generated by pyBigWig.
RUN curl --fail --location --output /usr/local/bin/bedGraphToBigWig \
        "${BEDGRAPH_TO_BIGWIG_URL}" \
    && echo "${BEDGRAPH_TO_BIGWIG_SHA256}  /usr/local/bin/bedGraphToBigWig" \
        | sha256sum --check --strict \
    && chmod 0755 /usr/local/bin/bedGraphToBigWig

COPY requirements-pipeline.txt /opt/tapestry/requirements-pipeline.txt
COPY --from=python-deps-installer \
     /opt/tapestry/site-packages \
     /usr/local/lib/python3.11/site-packages

# Guard the FIPS-host portability invariant: neither HTSlib binding may
# reintroduce a private OpenSSL library through a binary PyPI wheel.
RUN bundled_crypto="$(find /usr/local/lib/python3.11/site-packages \
        -type f \( \
          -path '*/pysam.libs/libcrypto*' \
          -o -path '*/cyvcf2.libs/libcrypto*' \
        \) -print)" \
    && if [ -n "${bundled_crypto}" ]; then \
         echo "Unexpected bundled OpenSSL libraries:" >&2; \
         echo "${bundled_crypto}" >&2; \
         exit 1; \
       fi

COPY --from=gtg-builder /build/gtg/code/rust/target/release/gtg-ped-map /usr/local/bin/gtg-ped-map
COPY --from=gtg-builder /build/gtg/code/rust/target/release/gtg-concordance /usr/local/bin/gtg-concordance
COPY src /opt/tapestry/src

ENV PYTHONPATH=/opt/tapestry/src:/opt/tapestry/src/util

RUN gtg-ped-map --version \
    && gtg-concordance --version \
    && test -x /usr/local/bin/bedGraphToBigWig \
    && bcftools --version \
    && python /opt/tapestry/src/tapestry_validate.py --help \
    && python /opt/tapestry/src/filter_model_beds.py --help \
    && python /opt/tapestry/src/normalize_joint_vcf.py --help \
    && python /opt/tapestry/src/run_gtg_inheritance.py --help \
    && python /opt/tapestry/src/plot_haplotype_ancestry.py --help \
    && python /opt/tapestry/src/summarize_haplotype_methylation.py --help \
    && python /opt/tapestry/src/summarize_transmission_methylation.py --help \
    && python /opt/tapestry/src/capture_versions.py --help \
    && python /opt/tapestry/src/generate_reference_cpgs.py --help \
    && python /opt/tapestry/src/phase_meth_to_founder_haps.py --help \
    && python /opt/tapestry/src/expand_model_to_all_cpgs.py --help \
    && python /opt/tapestry/src/write_results_manifest.py --help

WORKDIR /work