From ca2f6a673a9fd614f7db3c5d71b92fe5f53b6cfe Mon Sep 17 00:00:00 2001
From: Doster-d <63081538+Doster-d@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:38:56 +0300
Subject: [PATCH] build(runtime): harden embedding image policy

---
 Dockerfile                 | 3 ++-
 tests/test_image_policy.py | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index e915d66..3ec63a7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,8 @@ RUN python -m venv /home/nonroot/venv \
     && /home/nonroot/venv/bin/pip install --no-cache-dir -r requirements.txt
 
 FROM dependencies AS quality
-ENV PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache
+ENV VIRTUAL_ENV=/home/nonroot/venv \
+    PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache
 COPY requirements-test.txt Dockerfile README.md server.py /home/nonroot/app/
 COPY tests /home/nonroot/app/tests
 RUN /home/nonroot/venv/bin/pip install --no-cache-dir -r requirements-test.txt \
diff --git a/tests/test_image_policy.py b/tests/test_image_policy.py
index deb48ee..ba42df1 100644
--- a/tests/test_image_policy.py
+++ b/tests/test_image_policy.py
@@ -64,6 +64,7 @@ def test_quality_evidence_is_reproducible_and_taxonomy_aware_TASK_8c19d6a7() ->
     assert pinned_tools["ruff"] == "0.15.19"
     assert pinned_tools["ty"] == "0.0.53"
     assert "AS quality" in dockerfile
+    assert "VIRTUAL_ENV=/home/nonroot/venv" in dockerfile
     assert "PYTHONPYCACHEPREFIX=/tmp/embedding-runtime-pycache" in dockerfile
     assert "python -m pytest -p no:cacheprovider tests" in dockerfile
     assert "ruff check server.py tests" in dockerfile