chore: import upstream snapshot with attribution

docker/Dockerfile.base

@@ -0,0 +1,35 @@
+# Pinned digest defaults so the base images are resolvable by hash even when
+# the args are not passed (e.g. by supply-chain scanners or a plain `docker build`).
+# docker/docker-bake.hcl overrides these at build time; keep the digests in sync.
+ARG build_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
+ARG base_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
+
+FROM ${build_image} AS build-image
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG haystack_version
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git
+
+COPY --from=ghcr.io/astral-sh/uv:0.11.17@sha256:03bdc89bb9798628846e60c3a9ad19006c8c3c724ccd2985a33145c039a0577b /uv /uvx /bin/
+
+# Shallow clone Haystack repo, we'll install from the local sources
+RUN git clone --depth=1 --branch=${haystack_version} https://github.com/deepset-ai/haystack.git /opt/haystack
+WORKDIR /opt/haystack
+
+# Use a virtualenv we can copy over the next build stage
+# Note: we use venv and not uv to create the virtualenv to make sure that the created virtualenv is accessible by pip
+# and prevent breaking changes in the image. uv can still be used to speed up installation.
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Upgrade setuptools due to https://nvd.nist.gov/vuln/detail/CVE-2022-40897
+RUN uv pip install --no-cache-dir -U setuptools && \
+    uv pip install --no-cache-dir .
+
+FROM ${base_image} AS final
+
+COPY --from=build-image /opt/venv /opt/venv
+
+ENV PATH="/opt/venv/bin:$PATH"

docker/README.md

@@ -0,0 +1,57 @@
+<p align="center">
+  <a href="https://haystack.deepset.ai/"><img src="https://raw.githubusercontent.com/deepset-ai/.github/main/haystack-logo-colored.png" alt="Haystack by deepset"></a>
+</p>
+
+[Haystack](https://github.com/deepset-ai/haystack) is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Whether you want to perform retrieval-augmented generation (RAG), document search, question answering or answer generation, Haystack can orchestrate state-of-the-art embedding models and LLMs into pipelines to build end-to-end NLP applications and solve your use case.
+
+## Haystack 2.x
+
+For the latest version of Haystack there's only one image available:
+
+- `haystack:base-<version>` contains a working Python environment with Haystack preinstalled. This image is expected to
+  be derived `FROM`.
+
+## Image Development
+
+Images are built with BuildKit and we use `bake` to orchestrate the process.
+You can build a specific image by running:
+```sh
+docker buildx bake base
+```
+
+You can override any `variable` defined in the `docker-bake.hcl` file and build custom
+images, for example if you want to use a branch from the Haystack repo, run:
+```sh
+HAYSTACK_VERSION=mybranch_or_tag BASE_IMAGE_TAG_SUFFIX=latest docker buildx bake base --no-cache
+```
+
+### Multi-Platform Builds
+
+Haystack images support multiple architectures. But depending on your operating system and Docker
+environment, you might not be able to build all of them locally.
+
+You may encounter the following error when trying to build the image:
+
+```
+multiple platforms feature is currently not supported for docker driver. Please switch to a different driver
+(eg. “docker buildx create --use”)
+```
+
+To get around this, you need to override the `platform` option and limit local builds to the same architecture as
+your computer's. For example, on an Apple M1 you can limit the builds to ARM only by invoking `bake` like this:
+
+```sh
+docker buildx bake base --set "*.platform=linux/arm64"
+```
+
+# License
+
+View [license information](https://github.com/deepset-ai/haystack/blob/main/LICENSE) for
+the software contained in this image.
+
+As with all Docker images, these likely also contain other software which may be under
+other licenses (such as Bash, etc from the base distribution, along with any direct or
+indirect dependencies of the primary software being contained).
+
+As for any pre-built image usage, it is the image user's responsibility to ensure that any
+use of this image complies with any relevant licenses for all software contained within.

docker/docker-bake.hcl

@@ -0,0 +1,40 @@
+variable "HAYSTACK_VERSION" {
+  default = "main"
+}
+
+variable "GITHUB_REF" {
+  default = ""
+}
+
+variable "IMAGE_NAME" {
+  default = "deepset/haystack"
+}
+
+variable "IMAGE_TAG_SUFFIX" {
+  default = "local"
+}
+
+variable "BASE_IMAGE_TAG_SUFFIX" {
+  default = "local"
+}
+
+variable "IS_STABLE" {
+  default = "false"
+}
+
+# 2.Y.Z releases are also tagged as "stable"
+# Example: 2.99.0 is tagged as base-2.99.0 and stable
+
+target "base" {
+  dockerfile = "Dockerfile.base"
+  tags = "${compact([
+    "${IMAGE_NAME}:base-${IMAGE_TAG_SUFFIX}",
+    equal("${IS_STABLE}", "true") ? "${IMAGE_NAME}:stable" : ""
+  ])}"
+  args = {
+    build_image = "python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203"
+    base_image = "python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203"
+    haystack_version = "${HAYSTACK_VERSION}"
+  }
+  platforms = ["linux/amd64", "linux/arm64"]
+}