All container images used across every service, environment, and dependency.
Summary
| Category |
Count |
| Application images (ACR) |
10 |
| Application images (PP Harbor) |
6 |
| Base / builder images |
6 |
| Platform dependency images (Hatchet) |
6 |
| Platform dependency images (Weaviate) |
2 |
| Platform dependency images (PostgreSQL) |
3 |
| Platform dependency images (Redis) |
1 |
| Other (LiteLLM, curl, etc.) |
3 |
1. Application Images — Azure ACR (ai71uaenprodask71acr01.azurecr.io)
Built by GitLab CI and deployed in all Azure environments (dev, stg, prod-mufti, atrc, edge). Tags track the Git commit SHA; latest is used in dev.
core-service
| Field |
Value |
| Dockerfile |
Dockerfile |
| Port |
8000 |
| Entrypoint |
uvicorn core_service.app:app --host 0.0.0.0 --port 8000 |
| Builder base |
python:3.12 |
| Runtime base |
python:3.12-slim |
| System packages |
libpq-dev (psycopg2 native driver) |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src, NLTK_DATA=/app/nltk_data |
| Files copied |
src/, alembic/, alembic.ini, config/default.toml |
| Private PyPI indexes |
connectors-lib, iam-client, logger-sdk, foundry-client, storage-lib |
| Purpose |
Main REST API — user auth, subscriptions, API key management, notifications, billing |
core-service-bulk-operations-worker
| Field |
Value |
| Dockerfile |
Dockerfile.bulk_operations_worker |
| Entrypoint |
python src/core_service/hatchet/workers/bulk_operations_worker.py |
| Builder base |
python:3.12 |
| Runtime base |
python:3.12-slim |
| System packages |
libpq-dev |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src, HATCHET_ENV=production, UV_COMPILE_BYTECODE=1 |
| Files copied |
src/core_service/, src/model_provider/, src/billing_metering/, src/config/, config/default.toml |
| Private PyPI indexes |
connectors-lib, iam-client, logger-sdk, foundry-client, storage-lib |
| Purpose |
Hatchet worker — processes bulk data operations (import/export, bulk user actions) |
core-service-billing-metering-worker
| Field |
Value |
| Dockerfile |
Dockerfile.billing_metering_worker |
| Entrypoint |
python src/billing_metering/hatchet/workers/billing_metering_worker.py |
| Builder base |
python:3.12 |
| Runtime base |
python:3.12-slim |
| System packages |
libpq-dev |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src, HATCHET_ENV=production, UV_COMPILE_BYTECODE=1 |
| Files copied |
src/billing_metering/, src/core_service/, src/config/, config/default.toml |
| Private PyPI indexes |
connectors-lib, iam-client, logger-sdk, foundry-client, storage-lib |
| Purpose |
Hatchet worker — tracks usage events, reports to Autumn/Stripe billing, processes webhook events |
| PP status |
❌ Disabled (billing not active in PP) |
core-service-cron-scheduler-worker
| Field |
Value |
| Dockerfile |
Dockerfile.cron_scheduler_worker |
| Entrypoint |
python src/core_service/hatchet/workers/cron_scheduler_worker.py |
| Builder base |
python:3.12 |
| Runtime base |
python:3.12-slim |
| System packages |
libpq-dev |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src, HATCHET_ENV=production, UV_COMPILE_BYTECODE=1 |
| Files copied |
src/core_service/, src/model_provider/, src/config/, config/default.toml |
| Private PyPI indexes |
connectors-lib, iam-client, logger-sdk, foundry-client, storage-lib |
| Purpose |
Hatchet worker — triggers scheduled/recurring jobs (cron-style task dispatch) |
| PP status |
❌ Disabled |
core-service-job-run-worker
| Field |
Value |
| Dockerfile |
Dockerfile.job_run_worker |
| Entrypoint |
python src/core_service/hatchet/workers/job_run_worker.py |
| Builder base |
python:3.12 |
| Runtime base |
python:3.12-slim |
| System packages |
libpq-dev |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src, HATCHET_ENV=production, UV_COMPILE_BYTECODE=1 |
| Files copied |
src/core_service/, src/model_provider/, src/config/, config/default.toml |
| Private PyPI indexes |
connectors-lib, iam-client, logger-sdk, foundry-client, storage-lib |
| Purpose |
Hatchet worker — executes on-demand job runs triggered by the Core Service API |
| PP status |
❌ Disabled |
assistant-service (used for 3 deployments)
The same image is deployed three times with different CMD overrides via Helm:
| Deployment |
Port |
Gunicorn app |
Workers |
Memory limit |
| Assistants API |
8000 |
src.assistants.app:app |
1–4 (env GUNICORN_WORKERS) |
768 Mi |
| Intelligence |
8003 |
src.intelligence.app:app |
1 (fixed) |
10 Gi |
| Tooling / ToolBus |
8001 |
src.tooling.app:app |
1 (fixed) |
2 Gi |
| Field |
Value |
| Dockerfile |
Dockerfile (assistants) · Dockerfile-intelligence · Dockerfile-tooling |
| Builder base |
python:3.12-trixie |
| Runtime base |
python:3.12-slim-trixie |
| System packages |
pandoc (document conversion — Markdown, DOCX, PDF) |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src |
| Files copied |
src/, alembic/, alembic.ini, config/default.toml, config/feature-flags/, config_files/, configs/, assets/ |
| Reload support |
ARG RELOAD → --reload flag passed to Gunicorn (dev hot-reload) |
| Private PyPI indexes |
tii_gitlab (ask-group + core-group), gitlab-eval, ask-feature-flags |
| Key runtime deps |
FastAPI, LangGraph, LangChain, OpenAI SDK, Hatchet, spaCy, fastMCP, MCP, MLflow, mem0ai |
| Tooling extras |
Dockerfile-tooling includes a separate code-executor-container stage (python:3.12-slim-trixie, user coderunner uid 1000, isolated Python REPL) |
ask-knowledge-management-service
| Field |
Value |
| Dockerfile |
Dockerfile |
| Port |
8000 |
| Entrypoint |
gunicorn -c gunicorn_conf.py knowledge_management_service.app:app |
| Builder base |
ghcr.io/astral-sh/uv:0.10.2-python3.12-trixie (official uv image — no separate pip install) |
| Runtime base |
python:3.12-slim-trixie |
| System packages |
None (uv image handles all Python tooling at build time) |
| Env vars baked in |
PYTHONUNBUFFERED=1, PYTHONPATH=/app/src, UV_COMPILE_BYTECODE=0 |
| Files copied |
src/, alembic_migrations/, alembic.ini, config/default.toml, gunicorn_conf.py |
| Private PyPI indexes |
CONNECTORS_LIB, DOCUMENT_UNDERSTANDING, IAM_CLIENT, STORAGE_LIB, FOUNDRY_CLIENT |
| Key runtime deps |
FastAPI, SQLAlchemy, Weaviate client, document-understanding, hatchet-sdk, mlflow, scikit-learn |
| PP storage |
S3-compatible (s3.pp.gov.ae) — CA bundle mounted at /config/s3/s3-cert.pem |
| Same image used for |
Main API, ingestion worker, generic worker, live ingestion worker (command override per deployment) |
frontend / frontend-dev / frontend-stg / frontend-prod / frontend-mec1-stg
All variants are built from the same Dockerfile (apps/web/Dockerfile) with a different ENV_FILE build argument. The image tag and ENV_FILE differ per environment.
| Image tag suffix |
ENV_FILE arg |
Environment |
(default / frontend) |
.env.production |
Production |
-dev |
.env.development |
Development |
-stg |
.env.staging |
Staging |
-prod |
.env.production |
Production variant |
-mec1-stg |
.env.mec1-staging |
MEC1 Staging |
| Field |
Value |
| Dockerfile |
apps/web/Dockerfile (Turborepo monorepo) |
| Port |
3000 |
| Entrypoint |
node --max-old-space-size-percentage=75 apps/web/server.js |
| Build stages |
base (node:22-alpine + corepack) → pruner (turbo prune) → builder (pnpm install + turbo build) → runner |
| Builder base |
node:22-alpine + turbo prune --scope=web |
| Runtime base |
node:22-alpine (standalone Next.js — no node_modules in runner) |
| System packages |
libc6-compat (Alpine glibc shim) |
| Env vars baked in |
NODE_ENV=production, NEXT_TELEMETRY_DISABLED=1, PORT=3000 |
| Runtime user |
nextjs (uid 1001, gid 1001 nodejs) — non-root |
| Build-time args |
ENV_FILE (env config), COMMIT_SHA (embedded in Sentry release ID) |
| Memory |
Build: NODE_OPTIONS=--max-old-space-size=4096; Runtime: --max-old-space-size-percentage=75 |
| PP note |
NODE_TLS_REJECT_UNAUTHORIZED=0 set via Helm env: (private CA on *.ask.pp.gov.ae) |
2. Application Images — PP Harbor (registry.pp.gov.ae/ask/)
Mirrored from ACR before each PP deployment using mirror-image.sh.
| Image |
Tag |
Mirrored From |
ask/ask-core-service |
b4895f50 (pinned) |
ai71uaenprodask71acr01.azurecr.io/core-service |
ask/ask-core-service-bulk-operations-worker |
pinned |
ai71uaenprodask71acr01.azurecr.io/core-service-bulk-operations-worker |
ask/ask-assistant-service |
d1fec387 (pinned) |
ai71uaenprodask71acr01.azurecr.io/assistant-service |
ask/ask-knowledge-management-service |
88ca403f (pinned) |
ai71uaenprodask71acr01.azurecr.io/ask-knowledge-management-service |
ask/frontend-prod |
staging-139ce0f1-pp-prod (pinned) |
ai71uaenprodask71acr01.azurecr.io/frontend-prod |
ask/ask-voice-service |
553d1ce0 (pinned) |
(voice-service ACR) |
3. Base & Builder Images (Dockerfile FROM)
Used only at build time — not present in running pods.
| Image |
Tag |
Used In |
Stage |
Purpose |
python:3.12 |
latest |
Core Service all Dockerfiles |
builder |
pip + uv dep install |
python:3.12-slim |
latest |
Core Service all Dockerfiles |
runtime |
Minimal Python runtime |
python:3.12-trixie |
latest |
Assistant Service Dockerfile, Dockerfile-intelligence, Dockerfile-tooling, Dockerfile-gateway |
builder |
pip + uv dep install (Debian Trixie) |
python:3.12-slim-trixie |
latest |
Assistant Service all Dockerfiles |
runtime |
Minimal Python runtime (Debian Trixie) |
ghcr.io/astral-sh/uv:0.10.2-python3.12-trixie |
0.10.2-python3.12-trixie |
KMS Dockerfile |
builder |
Official uv image (no separate pip install needed) |
ghcr.io/astral-sh/uv:${UV_VERSION}-python${PYTHON_VERSION}-${BASE_LAYER} |
parameterised |
KMS Dockerfile.ci-runner |
— |
CI runner with Docker CLI |
node:22-alpine |
latest |
Frontend apps/web/Dockerfile |
base, runner |
Node.js build and runtime |
> Proxy support: All Python Dockerfiles accept ARG PROXY_PREFIX or ARG DEPENDENCY_PROXY_PREFIX to route base image pulls through a registry mirror in air-gapped environments. |
|
|
|
|
Hatchet v0.71.0 is deployed from Harbor in PP. Chart version 0.10.0.
| Image |
Full Path (Harbor) |
Tag |
Purpose |
hatchet-api |
registry.pp.gov.ae/ghcr/hatchet/hatchet-api |
v0.71.0 |
Hatchet REST API server |
hatchet-engine |
registry.pp.gov.ae/ghcr/hatchet/hatchet-engine |
v0.71.0 |
Hatchet workflow engine |
hatchet-frontend |
registry.pp.gov.ae/ghcr/hatchet/hatchet-frontend |
v0.71.0 |
Hatchet web UI |
hatchet-migrate |
registry.pp.gov.ae/ghcr/hatchet/hatchet-migrate |
v0.71.0 |
DB migration job |
hatchet-admin |
registry.pp.gov.ae/ghcr/hatchet/hatchet-admin |
v0.71.0 |
Setup + seed jobs |
postgres |
registry.pp.gov.ae/dockerhub/library/postgres |
16-alpine |
Hatchet internal PostgreSQL |
bitnami/postgresql (Hatchet subchart) |
registry.pp.gov.ae/bitnamilegacy/postgresql |
17.6.0-debian-12-r4 |
Hatchet Bitnami PostgreSQL |
bitnami/rabbitmq |
registry.pp.gov.ae/bitnamilegacy/rabbitmq |
4.1.3-debian-12-r1 |
Hatchet message queue |
Weaviate chart 17.7.0. 3-replica cluster.
| Image |
Full Path (Harbor) |
Tag |
Purpose |
weaviate |
registry.pp.gov.ae/dockerhub/weaviate |
1.34.0 |
Vector database |
alpine (init container) |
registry.pp.gov.ae/dockerhub/library/alpine |
3.20 |
sysctlInitContainer — kernel tuning init |
6. Platform Dependency Images — PostgreSQL
Shared platform PostgreSQL (Bitnami chart 15.5.0) for Core Service, Assistant Service, Zitadel.
| Environment |
Image |
Tag |
Storage |
| PP (shared platform) |
registry.pp.gov.ae/bitnamilegacy/postgresql |
17.6.0-debian-12-r4 |
220 Gi primary, 20 Gi replica |
| PP (KMS dedicated) |
registry.pp.gov.ae/bitnami/postgresql |
18.1.0 |
300 Gi primary, 300 Gi replica |
| Azure / local dev |
bitnami/postgresql (docker.io) |
chart default |
Azure Flexible Server (prod) |
| Environment |
Image |
Tag |
Used By |
| PP |
registry.pp.gov.ae/bitnamilegacy/redis |
8.2.1-debian-12-r0 |
Assistant Service in-cluster Redis |
| Azure / local dev |
bitnami/redis (docker.io) |
8.11.1 |
Assistant Service Redis subchart |
8. Other Images
| Image |
Tag |
Where |
Purpose |
curlimages/curl |
latest |
Helm chart health-check jobs |
HTTP health check init containers |
postgres:15 |
15 |
Local docker-compose (assistant-service) |
Local dev PostgreSQL |
postgres:15-alpine |
15-alpine |
Local docker-compose (core-service) |
Local dev PostgreSQL |
postgres:16-alpine |
16-alpine |
Hatchet init job (PP) |
PostgreSQL init container |
Quick Reference — Image → Registry Matrix
| Image |
Docker Hub |
ACR |
PP Harbor |
GHCR |
| Application services |
— |
✅ (source) |
✅ (mirrored) |
— |
python:3.12* |
✅ |
— |
— |
— |
node:22-alpine |
✅ |
— |
— |
— |
debian:bookworm-slim |
✅ |
— |
— |
— |
uv |
— |
— |
— |
✅ (ghcr.io/astral-sh/uv) |
| Hatchet components |
— |
— |
✅ |
✅ (source) |
weaviate/weaviate |
✅ |
— |
✅ (mirrored) |
— |
bitnami/* |
✅ |
— |
✅ (mirrored as bitnamilegacy/*) |
— |