Dockerfile.langflow.dev

# Development Dockerfile for building Langflow from source
# Allows building from any Git branch/repo for testing

FROM python:3.14-slim AS builder

# Set environment variables
ENV DEBIAN_FRONTEND=noninteractive
ENV PYTHONUNBUFFERED=1
ENV RUSTFLAGS="--cfg reqwest_unstable"

# Accept build arguments for git repository and branch
ARG GIT_REPO=https://github.com/langflow-ai/langflow.git
ARG GIT_BRANCH=main

WORKDIR /app

# Install system dependencies
RUN apt-get update && apt-get install -y \
    build-essential \
    curl \
    git \
    ca-certificates \
    gnupg \
    npm \
    rustc cargo pkg-config libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Install uv for faster Python package management.
# Upgrade pip first to patch CVE-2026-8643 (fixed in 26.1.2) in the base image.
RUN pip install --no-cache-dir --upgrade "pip>=26.1.2" \
    && pip install --no-cache-dir uv

# Clone the repository and checkout the specified branch
RUN echo "Cloning ${GIT_REPO} branch ${GIT_BRANCH}..." && \
    git clone --depth 1 --branch ${GIT_BRANCH} ${GIT_REPO} /app

COPY scripts/patch_langflow_openrag_bundle.py /tmp/patch_langflow_openrag_bundle.py
RUN python3 /tmp/patch_langflow_openrag_bundle.py /app/src/frontend/src/utils/styleUtils.ts

# Install backend dependencies
RUN uv sync --frozen --no-install-project --no-editable --extra postgresql

# Build frontend (split into steps to reduce peak memory usage)
WORKDIR /app/src/frontend
ENV PUPPETEER_SKIP_DOWNLOAD=true
# Install dependencies first
RUN npm ci --maxsockets 1
# Build with reduced memory - 4GB should be safer for most systems
RUN NODE_OPTIONS="--max_old_space_size=4096 --max-semi-space-size=128" npm run build
# Copy built frontend
RUN mkdir -p /app/src/backend/base/langflow/frontend && \
    cp -r build/* /app/src/backend/base/langflow/frontend/

# Return to app directory and install the project
WORKDIR /app
RUN uv sync --frozen --no-dev --no-editable --extra postgresql
RUN uv pip uninstall litellm ragstack-ai-knowledge-store

COPY custom_components/ /app/custom_components/

# Expose ports
EXPOSE 7860

ENV LANGFLOW_SSRF_ALLOWED_HOSTS=localhost,127.0.0.1,host.docker.internal
ENV LANGFLOW_LOG_TRACE_LOCALS=false
ENV LANGFLOW_LOG_FORMAT=key_value
ENV LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true
ENV LANGFLOW_COMPONENTS_PATH=/app/custom_components
ENV LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
ENV LANGFLOW_DANGEROUSLY_ALLOW_MULTI_WORKER_WITHOUT_SHARED_QUEUE=true
ENV LANGFLOW_DISABLE_TRACK_APIKEY_USAGE=true

# CWE-426 fix: explicitly set PATH so system-owned directories are always resolved
# first. App venv and ubi python dirs are appended last so they cannot shadow system binaries.
ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/app/.venv/bin:/opt/app-root/bin:/opt/app-root/src/bin:/opt/app-root/src/.local/bin

# Start the backend server
CMD ["uv", "run", "langflow", "run", "--host", "0.0.0.0", "--port", "7860"]