chore: import upstream snapshot with attribution

docker/Dockerfile.base

@@ -0,0 +1,35 @@
+# Pinned digest defaults so the base images are resolvable by hash even when
+# the args are not passed (e.g. by supply-chain scanners or a plain `docker build`).
+# docker/docker-bake.hcl overrides these at build time; keep the digests in sync.
+ARG build_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
+ARG base_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203
+
+FROM ${build_image} AS build-image
+
+ARG DEBIAN_FRONTEND=noninteractive
+ARG haystack_version
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git
+
+COPY --from=ghcr.io/astral-sh/uv:0.11.17@sha256:03bdc89bb9798628846e60c3a9ad19006c8c3c724ccd2985a33145c039a0577b /uv /uvx /bin/
+
+# Shallow clone Haystack repo, we'll install from the local sources
+RUN git clone --depth=1 --branch=${haystack_version} https://github.com/deepset-ai/haystack.git /opt/haystack
+WORKDIR /opt/haystack
+
+# Use a virtualenv we can copy over the next build stage
+# Note: we use venv and not uv to create the virtualenv to make sure that the created virtualenv is accessible by pip
+# and prevent breaking changes in the image. uv can still be used to speed up installation.
+RUN python3 -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Upgrade setuptools due to https://nvd.nist.gov/vuln/detail/CVE-2022-40897
+RUN uv pip install --no-cache-dir -U setuptools && \
+    uv pip install --no-cache-dir .
+
+FROM ${base_image} AS final
+
+COPY --from=build-image /opt/venv /opt/venv
+
+ENV PATH="/opt/venv/bin:$PATH"