27.9-dars: Docker bilan konteynerlash

VIRTUAL MASHINA (VM)                 KONTEYNER
+-----------+ +-----------+          +---------+ +---------+ +---------+
| ilova A   | | ilova B   |          | ilova A | | ilova B | | ilova C |
| kutubxona | | kutubxona |          | kutubx. | | kutubx. | | kutubx. |
| MEHMON OT | | MEHMON OT |          +---------+ +---------+ +---------+
+-----------+ +-----------+          |     konteyner runtime (Docker)     |
|        GIPERVIZOR        |          +-----------------------------------+
+--------------------------+          |      XOST OT YADROSI (Linux)      |
|   XOST OT / apparatura   |          +-----------------------------------+
+--------------------------+          |           apparatura              |

VM:        har biri TO'LIQ operatsion tizim (yadro bilan)
           ishga tushish - o'nlab soniya/daqiqa, hajm - GB lar
           izolyatsiya kuchli (alohida yadro)

KONTEYNER: yadro UMUMIY, faqat foydalanuvchi qismi alohida
           ishga tushish - soniyadan kam, hajm - o'nlab/yuzlab MB
           izolyatsiya: Linux namespaces (ko'rinish) + cgroups (resurs)

Dockerfile --(docker build)--> IMAGE --(docker run)--> KONTEYNER
 (retsept)                   (o'zgarmas             (ishlayotgan nusxa,
                              qatlamlar to'plami)    ustida yoziladigan qatlam)
                                 |
                          (docker push/pull)
                                 v
                             REGISTRY
                 (Docker Hub, kompaniya ichki registri)

IMAGE NOMI:  registry.misol.uz/ml/churn-api:1.4.2
             \_______________/ \___________/ \___/
                  registry        repozitoriy    teg

TEG vs DIGEST:
  churn-api:1.4.2          - teg, KO'CHIRILISHI mumkin (boshqa image ga)
  churn-api@sha256:3f9a... - digest, mazmun xeshi, O'ZGARMAS

FROM python:3.12.7-slim            # asos image - har doim aniq versiya
WORKDIR /app                       # ishchi papka (yo'q bo'lsa yaratiladi)
ENV PYTHONUNBUFFERED=1             # muhit o'zgaruvchisi (build va run da)
COPY requirements.txt .            # kontekstdan image ga nusxa
RUN pip install --no-cache-dir -r requirements.txt   # build vaqtida buyruq
COPY ilova/ ./ilova/
RUN useradd --create-home --uid 10001 ilova
USER ilova                         # bundan keyingi hamma narsa shu foydalanuvchi
EXPOSE 8000                        # HUJJAT: ilova shu portni tinglaydi
HEALTHCHECK --interval=30s CMD python -c "import urllib.request as u; u.urlopen('http://localhost:8000/health')"
CMD ["uvicorn", "ilova.server:app", "--host", "0.0.0.0", "--port", "8000"]

ENTRYPOINT ["python", "-m", "ilova"]     CMD ["serve"]
  docker run image                -> python -m ilova serve
  docker run image baholash       -> python -m ilova baholash   (CMD almashdi)

SHELL shakli:  CMD python -m ilova.server
  -> /bin/sh -c "python -m ilova.server"
  -> PID 1 = sh, Python emas -> SIGTERM Python ga YETMAYDI
  -> docker stop 10 soniya kutadi va SIGKILL: so'rovlar yarim yo'lda uziladi
JSON (exec) shakli: CMD ["python", "-m", "ilova.server"]
  -> PID 1 = python, SIGTERM ni o'zi oladi -> toza to'xtash

Har ko'rsatma -> bitta QATLAM. Image = qatlamlar to'plami.

KESH KALITI (soddalashtirilgan):
  kalit(qatlam) = xesh( kalit(ota qatlam) + ko'rsatma matni
                        + COPY/ADD bo'lsa: nusxalangan fayllar mazmuni )

  -> bitta qatlam o'zgarsa, undan PASTDAGI hammasi qayta quriladi
  -> RUN kaliti buyruq MATNIGA bog'liq, natijasiga emas

YOMON TARTIB:                        YAXSHI TARTIB:
  FROM python:3.12.7-slim              FROM python:3.12.7-slim
  WORKDIR /app                         WORKDIR /app
  COPY . .            <- kod           COPY requirements.txt .   <- kam o'zgaradi
  RUN pip install ... <- 95 s          RUN pip install ...       <- keshdan
  CMD [...]                            COPY ilova/ ./ilova/      <- kod
                                       CMD [...]
  kod o'zgardi -> pip QAYTA            kod o'zgardi -> faqat oxirgi COPY

# 1-bosqich: qurish - kompilyator va sarlavha fayllari shu yerda qoladi
FROM python:3.12.7-slim AS quruvchi
RUN apt-get update && \
    apt-get install -y --no-install-recommends gcc && \
    rm -rf /var/lib/apt/lists/*
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# 2-bosqich: ishga tushirish - faqat tayyor paketlar
FROM python:3.12.7-slim
COPY --from=quruvchi /install /usr/local
COPY ilova/ /app/ilova/

NIMA BERADI:
  yakuniy image da gcc, sarlavhalar, build keshi YO'Q
  -> kichikroq (ko'pincha yuzlab MB farq)
  -> hujum yuzasi kichik (kompilyator yo'q)
  -> faqat OXIRGI bosqich yetkaziladi; oraliq bosqichlar keshda qoladi

ML DA TIPIK:
  quruvchi: paketlarni kompilyatsiya, modelni eksport/tekshirish
  yakuniy:  runtime + model artefakti + ilova kodi

python:3.12.7          ~1 GB atrofida   to'liq Debian, gcc bor, qulay, katta
python:3.12.7-slim     ~50 MB atrofida  minimal Debian - ML uchun odatda eng yaxshi
python:3.12.7-alpine   eng kichik       musl libc: ko'p ML g'ildiraklari (wheel)
                                        yo'q -> numpy/scipy manbadan kompilyatsiya,
                                        sekin va xatoga moyil
distroless / chiseled  juda kichik      shell ham yo'q - xavfsiz, lekin
                                        nosozlikni tuzatish qiyin

(hajmlar taxminiy, versiyaga qarab o'zgaradi - rasmiy sahifaga qarang)

ML UCHUN TIPIK TANLOV: -slim + multi-stage
TORCH: CPU uchun alohida g'ildirak (index-url .../cpu) - CUDA versiyasi GB lab

1. ROOT EMAS FOYDALANUVCHI
   Sukut bo'yicha konteyner ichida jarayon root (UID 0).
   Ilovada zaiflik bo'lsa -> hujumchi konteyner ichida root;
   yadro umumiy bo'lgani uchun qochish xavfi oshadi.
   RUN useradd --uid 10001 ilova   +   USER ilova

2. SIRLAR IMAGE GA YOZILMASIN
   ENV DB_PAROL=...   -> image metadata sida, `docker history` da ko'rinadi
   ARG TOKEN=...      -> build tarixida qoladi
   COPY .env .        -> fayl qatlamda qoladi (keyin RUN rm ham yordam bermaydi:
                         oldingi qatlam baribir image ichida!)
   TO'G'RI:
     runtime sir:  docker run -e / orkestrator secret / secret manager
     build sir:    RUN --mount=type=secret,id=pip_token ...  (qatlamga tushmaydi)

3. .dockerignore
   docker build . -> butun papka (KONTEKST) builder ga yuboriladi
   .git, .venv, data/, .env -> sekin build + sir oqishi

QATLAMLAR "O'CHIRISHNI" BILMAYDI:
  COPY .env /app/.env          qatlam 5: .env bor
  RUN rm /app/.env             qatlam 6: ".env o'chirildi" belgisi
  -> yakuniy fayl tizimida .env ko'rinmaydi,
     lekin qatlam 5 image ichida: `docker save` bilan ochib olish mumkin

12-FACTOR APP (III. Config): konfiguratsiya MUHITDA, kodda emas

BITTA IMAGE  --->  dev      ILOVA_MUHIT=dev      ILOVA_LOG_DARAJASI=DEBUG
             --->  staging  ILOVA_MUHIT=staging
             --->  prod     ILOVA_MUHIT=prod     ILOVA_ISHCHILAR=8

QOIDALAR:
  image muhitga bog'liq EMAS - sinovdan o'tgan image aynan prod ga boradi
  konfiguratsiya ishga tushishda VALIDATSIYA qilinadi -> xato darhol,
    birinchi so'rovda emas ("fail fast")
  noma'lum o'zgaruvchi (imlo xatosi) - xato, jim e'tiborsiz emas
  sirlar SecretStr - repr, log va JSON da niqoblangan

from pydantic import SecretStr
from pydantic_settings import BaseSettings, SettingsConfigDict


class Sozlamalar(BaseSettings):
    model_config = SettingsConfigDict(env_prefix="ILOVA_", extra="forbid")

    muhit: str
    port: int = 8000
    db_url: SecretStr


sozlamalar = Sozlamalar()          # os.environ dan o'qiydi va tekshiradi

# docker-compose.yml - lokal ishlab chiqish va sinov uchun
services:
  api:
    build: .
    image: churn-api:dev
    ports:
      - "8000:8000"
    environment:
      ILOVA_MUHIT: dev
      ILOVA_MODEL_YOLI: /models/model.joblib
    env_file:
      - .env                      # sirlar: git ga va image ga TUSHMAYDI
    volumes:
      - ./artefakt:/models:ro     # model faqat o'qish uchun
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped

  db:
    image: postgres:17.2
    environment:
      POSTGRES_DB: ml
      POSTGRES_USER: ilova
      POSTGRES_PASSWORD_FILE: /run/secrets/db_parol
    secrets:
      - db_parol
    volumes:
      - pgdata:/var/lib/postgresql/data   # konteyner o'chsa ham ma'lumot qoladi
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ilova -d ml"]
      interval: 5s
      retries: 10

volumes:
  pgdata:

secrets:
  db_parol:
    file: ./secrets/db_parol.txt

MUHIM JOYLAR:
  api -> db ga "db:5432" nomi bilan ulanadi (compose ichki DNS)
  depends_on + healthcheck: DB TAYYOR bo'lgandan keyin API boshlanadi
  volume: DB fayllari konteyner qatlamida emas
  compose - bitta mashina uchun; ko'p mashina - Kubernetes (27.10)

MODEL ARTEFAKTI QAYERDA?
  A) image ichida (COPY model.joblib)
     + image = kod + model, to'liq takrorlanadi, bitta digest
     - har yangi model -> yangi image; katta modelda image katta
  B) ishga tushishda registrdan yuklash 27.5-bob
     + image kichik, model mustaqil yangilanadi
     - ishga tushish sekinroq, registr mavjudligiga bog'liq,
       "qaysi model ishlayapti" - alohida kuzatish kerak
  Kichik tabular modellar uchun A odatda soddaroq.

GPU:
  xostda drayver + NVIDIA Container Toolkit, image da CUDA runtime
  docker run --gpus all ...
  CUDA image lar GB lab - CPU inference uchun CPU g'ildiraklari

ISHCHILAR SONI:
  konteyner ichida ishchilar soni env dan (ILOVA_ISHCHILAR);
  masshtablash - odatda ko'proq KONTEYNER, bitta katta konteyner emas (27.10)

# ML API uchun namunaviy Dockerfile
FROM python:3.12.7-slim AS quruvchi
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

FROM python:3.12.7-slim
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
RUN useradd --create-home --uid 10001 ilova
WORKDIR /app
COPY --from=quruvchi /install /usr/local
COPY --chown=ilova:ilova ilova/ ./ilova/
COPY --chown=ilova:ilova artefakt/model.joblib ./artefakt/
USER ilova
EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request as u; u.urlopen('http://localhost:8000/health')"
CMD ["uvicorn", "ilova.server:app", "--host", "0.0.0.0", "--port", "8000"]

# .dockerignore
.git
.venv
**/__pycache__
**/*.pyc
.env
.env.*
data/
!data/schema.json
notebooks/
tests/

docker build -t churn-api:1.4.2 .                 # qurish
docker build --progress=plain -t churn-api:dev .  # har qadam va CACHED belgilari
docker images churn-api                           # hajmlar
docker history churn-api:1.4.2                    # qatlamlar va ularning hajmi
docker run --rm -p 8000:8000 --env-file .env churn-api:1.4.2
docker run --rm churn-api:1.4.2 id                # uid=10001 bo'lishi kerak
docker exec -it <konteyner> sh                    # ichkariga kirish (tuzatish)
docker compose up --build                         # API + DB
docker compose down                               # to'xtatish (volume qoladi)
docker tag churn-api:1.4.2 registry.misol.uz/ml/churn-api:1.4.2
docker push registry.misol.uz/ml/churn-api:1.4.2

aniq teg (3.12.7-slim) -> requirements -> pip (--no-cache-dir) -> kod
multi-stage: gcc faqat quruvchi bosqichda
USER ilova, CMD JSON shaklida, HEALTHCHECK
.dockerignore: .git .venv .env data/ notebooks/
sirlar: faqat runtime env / secret, hech qachon ENV/ARG/COPY
konfiguratsiya: env -> pydantic -> ishga tushishda tekshiruv

"""Dockerfile lint noldan: qoidalar, ogohlantirishlar va jadval."""

import re
from dataclasses import dataclass

YOMON = """\
FROM python:latest
ENV DB_PAROL=supermaxfiy123
ADD . /app
WORKDIR /app
RUN apt-get update && apt-get install -y gcc
RUN pip install -r requirements.txt
RUN pip install pandas
EXPOSE 8000
CMD python -m ilova.server
"""

ORTA = """\
FROM python:3.12-slim
WORKDIR /app
COPY . .
RUN apt-get update && \\
    apt-get install -y --no-install-recommends gcc && \\
    rm -rf /var/lib/apt/lists/*
RUN pip install --no-cache-dir -r requirements.txt
EXPOSE 8000
CMD ["python", "-m", "ilova.server"]
"""

YAXSHI = """\
# 1-bosqich: qurish (kompilyator shu yerda qoladi)
FROM python:3.12.7-slim AS quruvchi
WORKDIR /build
RUN apt-get update && \\
    apt-get install -y --no-install-recommends gcc && \\
    rm -rf /var/lib/apt/lists/*
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# 2-bosqich: ishga tushirish (faqat kerakli narsa)
FROM python:3.12.7-slim
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
RUN useradd --create-home --uid 10001 ilova
WORKDIR /app
COPY --from=quruvchi /install /usr/local
COPY --chown=ilova:ilova ilova/ ./ilova/
USER ilova
EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request as u; u.urlopen('http://localhost:8000/health')"
CMD ["python", "-m", "ilova.server"]
"""

SIR_SOZLAR = ("PAROL", "PASSWORD", "SECRET", "TOKEN", "API_KEY", "KALIT")
DARAJA_TARTIBI = {"XATO": 0, "OGOH": 1, "MASLAHAT": 2}


@dataclass(frozen=True)
class Korsatma:
    qator: int
    buyruq: str
    argument: str


@dataclass(frozen=True)
class Topilma:
    qoida: str
    daraja: str
    qator: int
    xabar: str


def tahlil(matn):
    """Izohlarni tashlaydi, '\\' bilan davom etgan qatorlarni birlashtiradi."""
    natija, bufer, boshi = [], "", 0
    for i, xom in enumerate(matn.splitlines(), start=1):
        qator = xom.strip()
        if not bufer and (not qator or qator.startswith("#")):
            continue
        if not bufer:
            boshi = i
        if qator.endswith("\\"):
            bufer += qator[:-1] + " "
            continue
        toliq = (bufer + qator).strip()
        bufer = ""
        buyruq, _, argument = toliq.partition(" ")
        natija.append(Korsatma(boshi, buyruq.upper(), argument.strip()))
    return natija


def bosqichlar(korsatmalar):
    """Multi-stage: har FROM yangi bosqich boshlaydi."""
    royxat = []
    for k in korsatmalar:
        if k.buyruq == "FROM":
            royxat.append([])
        if royxat:
            royxat[-1].append(k)
    return royxat


def lint(matn):
    k_lar = tahlil(matn)
    topilmalar = []

    def qosh(qoida, daraja, qator, xabar):
        topilmalar.append(Topilma(qoida, daraja, qator, xabar))

    for k in k_lar:
        if k.buyruq == "FROM":
            image = k.argument.split()[0]
            teg = image.split(":")[1] if ":" in image else ""
            if teg in ("", "latest"):
                qosh("DL01", "XATO", k.qator,
                     f"pinlanmagan base image: {image}")
            elif not re.fullmatch(r"\d+\.\d+\.\d+.*", teg):
                qosh("DL02", "MASLAHAT", k.qator,
                     f"teg to'liq emas (patch yo'q): {image}")
        if k.buyruq in ("ENV", "ARG"):
            for juft in k.argument.split():
                nom, _, qiymat = juft.partition("=")
                if any(s in nom.upper() for s in SIR_SOZLAR) and qiymat:
                    qosh("DL03", "XATO", k.qator,
                         f"sir {k.buyruq} da: {nom}=*** (image tarixida qoladi)")
        if k.buyruq == "ADD" and "://" not in k.argument:
            qosh("DL04", "OGOH", k.qator, "mahalliy fayl uchun ADD emas, COPY")
        if k.buyruq == "RUN" and "apt-get install" in k.argument:
            if "rm -rf /var/lib/apt/lists" not in k.argument:
                qosh("DL05", "OGOH", k.qator,
                     "apt keshi shu RUN ichida tozalanmagan")
            if "--no-install-recommends" not in k.argument:
                qosh("DL06", "MASLAHAT", k.qator,
                     "--no-install-recommends yo'q (ortiqcha paketlar)")
        if k.buyruq == "RUN" and "pip install" in k.argument:
            if "--no-cache-dir" not in k.argument:
                qosh("DL07", "OGOH", k.qator,
                     "pip keshi image ga yoziladi (--no-cache-dir yo'q)")
            if "-r " not in k.argument:
                paketlar = [s for s in k.argument.split()[2:]
                            if not s.startswith("-")]
                pinsiz = [p for p in paketlar if "==" not in p]
                if pinsiz:
                    qosh("DL08", "OGOH", k.qator,
                         f"versiyasiz paket: {', '.join(pinsiz)}")
        if k.buyruq == "CMD" and not k.argument.startswith("["):
            qosh("DL09", "MASLAHAT", k.qator,
                 "CMD shell shaklida: SIGTERM ilovaga yetmaydi")

    # qatlam tartibi: kod butunlay nusxalanib, keyin bog'liqliklar o'rnatilsa
    for bosqich in bosqichlar(k_lar):
        hammasi_nusxa = None
        for k in bosqich:
            birinchi = k.argument.split()[0] if k.argument else ""
            if (k.buyruq in ("COPY", "ADD") and birinchi == "."
                    and hammasi_nusxa is None):
                hammasi_nusxa = k
            if (k.buyruq == "RUN" and "pip install" in k.argument
                    and hammasi_nusxa is not None):
                qosh("DL10", "XATO", hammasi_nusxa.qator,
                     "butun kod pip install dan OLDIN nusxalangan - "
                     "har kod o'zgarishida bog'liqliklar qayta o'rnatiladi")
                break

    # root: faqat OXIRGI bosqich ishga tushadi
    oxirgi = bosqichlar(k_lar)[-1]
    userlar = [k for k in oxirgi if k.buyruq == "USER"]
    if not userlar or userlar[-1].argument in ("root", "0"):
        qosh("DL11", "XATO", oxirgi[0].qator,
             "USER yo'q - konteyner root sifatida ishlaydi")
    if not any(k.buyruq == "HEALTHCHECK" for k in oxirgi):
        qosh("DL12", "MASLAHAT", oxirgi[0].qator, "HEALTHCHECK yo'q")
    return k_lar, sorted(topilmalar,
                         key=lambda t: (DARAJA_TARTIBI[t.daraja], t.qator))


def main() -> None:
    fayllar = {"yomon": YOMON, "orta": ORTA, "yaxshi": YAXSHI}

    print("=== 1. Tahlil: qatorlar -> ko'rsatmalar ===")
    k_lar = tahlil(ORTA)
    for k in k_lar:
        print(f"  {k.qator:>2} {k.buyruq:<8} {k.argument[:52]}")
    print(f"  fayl qatorlari: {len(ORTA.splitlines())}, "
          f"ko'rsatmalar: {len(k_lar)} (davom qatorlari birlashdi)")

    jadval = {}
    for nom, matn in fayllar.items():
        print(f"\n=== 2. Lint: {nom} ===")
        k_lar, topilmalar = lint(matn)
        for t in topilmalar:
            print(f"  {t.qoida} {t.daraja:<8} q{t.qator:<3} {t.xabar[:58]}")
        if not topilmalar:
            print("  topilma yo'q")
        jadval[nom] = (len(bosqichlar(k_lar)), topilmalar)

    print("\n=== 3. Umumiy jadval ===")
    print(f"  {'fayl':<8} {'bosqich':>7} {'XATO':>5} {'OGOH':>5} "
          f"{'MASLAHAT':>9}  qaror")
    for nom, (n_bosqich, topilmalar) in jadval.items():
        son = {d: sum(t.daraja == d for t in topilmalar)
               for d in DARAJA_TARTIBI}
        qaror = "RAD (CI to'xtaydi)" if son["XATO"] else "o'tdi"
        print(f"  {nom:<8} {n_bosqich:>7} {son['XATO']:>5} {son['OGOH']:>5} "
              f"{son['MASLAHAT']:>9}  {qaror}")

    print("\n=== 4. Linterning o'zini sinash: yaxshi faylga bitta buzilish ===")
    mutatsiyalar = {
        "USER qatori o'chirildi": YAXSHI.replace("USER ilova\n", ""),
        "teg -> latest": YAXSHI.replace("3.12.7-slim\nENV",
                                        "latest\nENV"),
        "ENV ga token": YAXSHI.replace("PYTHONUNBUFFERED=1",
                                       "PYTHONUNBUFFERED=1 HF_TOKEN=abc"),
        "COPY . . pip dan oldin": YAXSHI.replace(
            "COPY requirements.txt .", "COPY . ."),
    }
    kutilgan = {"USER qatori o'chirildi": "DL11", "teg -> latest": "DL01",
                "ENV ga token": "DL03", "COPY . . pip dan oldin": "DL10"}
    otdi = 0
    for nom, matn in mutatsiyalar.items():
        _, tl = lint(matn)
        qoidalar = sorted({t.qoida for t in tl})
        ushladi = kutilgan[nom] in qoidalar
        otdi += ushladi
        holat = "ushlandi" if ushladi else "o'tkazib yuborildi"
        print(f"  {nom:<24} -> {', '.join(qoidalar) or '-':<10} {holat}")
    print(f"  {otdi}/{len(mutatsiyalar)} buzilish ushlandi")

    print("\n=== 5. Qoidalar qamrovi ===")
    barcha = sorted({t.qoida for _, tl in jadval.values() for t in tl})
    print(f"  ishlagan qoidalar: {len(barcha)} ta: {', '.join(barcha)}")
    yaxshi_xato = [t for t in jadval["yaxshi"][1] if t.daraja == "XATO"]
    if not yaxshi_xato:
        print("  yaxshi Dockerfile da XATO yo'q - qoidalar ortiqcha qattiq emas")
    print("  ⭐ Lint - CI da har Dockerfile o'zgarishida arzon tekshiruv")


if __name__ == "__main__":
    main()

=== 1. Tahlil: qatorlar -> ko'rsatmalar ===
   1 FROM     python:3.12-slim
   2 WORKDIR  /app
   3 COPY     . .
   4 RUN      apt-get update &&  apt-get install -y --no-install-r
   7 RUN      pip install --no-cache-dir -r requirements.txt
   8 EXPOSE   8000
   9 CMD      ["python", "-m", "ilova.server"]
  fayl qatorlari: 9, ko'rsatmalar: 7 (davom qatorlari birlashdi)

=== 2. Lint: yomon ===
  DL01 XATO     q1   pinlanmagan base image: python:latest
  DL11 XATO     q1   USER yo'q - konteyner root sifatida ishlaydi
  DL03 XATO     q2   sir ENV da: DB_PAROL=*** (image tarixida qoladi)
  DL10 XATO     q3   butun kod pip install dan OLDIN nusxalangan - har kod o'zg
  DL04 OGOH     q3   mahalliy fayl uchun ADD emas, COPY
  DL05 OGOH     q5   apt keshi shu RUN ichida tozalanmagan
  DL07 OGOH     q6   pip keshi image ga yoziladi (--no-cache-dir yo'q)
  DL07 OGOH     q7   pip keshi image ga yoziladi (--no-cache-dir yo'q)
  DL08 OGOH     q7   versiyasiz paket: pandas
  DL12 MASLAHAT q1   HEALTHCHECK yo'q
  DL06 MASLAHAT q5   --no-install-recommends yo'q (ortiqcha paketlar)
  DL09 MASLAHAT q9   CMD shell shaklida: SIGTERM ilovaga yetmaydi

=== 2. Lint: orta ===
  DL11 XATO     q1   USER yo'q - konteyner root sifatida ishlaydi
  DL10 XATO     q3   butun kod pip install dan OLDIN nusxalangan - har kod o'zg
  DL02 MASLAHAT q1   teg to'liq emas (patch yo'q): python:3.12-slim
  DL12 MASLAHAT q1   HEALTHCHECK yo'q

=== 2. Lint: yaxshi ===
  topilma yo'q

=== 3. Umumiy jadval ===
  fayl     bosqich  XATO  OGOH  MASLAHAT  qaror
  yomon          1     4     5         3  RAD (CI to'xtaydi)
  orta           1     2     0         2  RAD (CI to'xtaydi)
  yaxshi         2     0     0         0  o'tdi

=== 4. Linterning o'zini sinash: yaxshi faylga bitta buzilish ===
  USER qatori o'chirildi   -> DL11       ushlandi
  teg -> latest            -> DL01       ushlandi
  ENV ga token             -> DL03       ushlandi
  COPY . . pip dan oldin   -> DL10       ushlandi
  4/4 buzilish ushlandi

=== 5. Qoidalar qamrovi ===
  ishlagan qoidalar: 12 ta: DL01, DL02, DL03, DL04, DL05, DL06, DL07, DL08, DL09, DL10, DL11, DL12
  yaxshi Dockerfile da XATO yo'q - qoidalar ortiqcha qattiq emas
  ⭐ Lint - CI da har Dockerfile o'zgarishida arzon tekshiruv

"""Qatlam keshi simulyatsiyasi: kalit zanjiri, ikki tartib, qayta qurish narxi.

Qatlam hajmlari va qurish vaqtlari FARAZIY (tipik ML image ga yaqin
tartibda tanlangan), haqiqiy o'lchov emas.
"""

import hashlib
import random
from dataclasses import dataclass

import numpy as np

# faraziy: (hajm MB, qurish soniyasi)
FARAZIY = {"FROM": (45.0, 0.0), "WORKDIR": (0.0, 0.0), "ENV": (0.0, 0.0),
           "COPY": (None, 1.0), "RUN": (380.0, 95.0), "CMD": (0.0, 0.0)}


@dataclass(frozen=True)
class Qadam:
    buyruq: str
    argument: str


@dataclass(frozen=True)
class Qatlam:
    qadam: Qadam
    kalit: str
    hajm_mb: float
    soniya: float


YOMON_TARTIB = [
    Qadam("FROM", "python:3.12.7-slim"),
    Qadam("WORKDIR", "/app"),
    Qadam("COPY", "."),
    Qadam("RUN", "pip install --no-cache-dir -r requirements.txt"),
    Qadam("CMD", '["python", "-m", "ilova.server"]'),
]

YAXSHI_TARTIB = [
    Qadam("FROM", "python:3.12.7-slim"),
    Qadam("WORKDIR", "/app"),
    Qadam("COPY", "requirements.txt"),
    Qadam("RUN", "pip install --no-cache-dir -r requirements.txt"),
    Qadam("COPY", "ilova/"),
    Qadam("CMD", '["python", "-m", "ilova.server"]'),
]


def boshlangich_fayllar():
    return {
        "requirements.txt": b"numpy==2.3.1\npandas==3.0.0\n"
                            b"scikit-learn==1.9.0\nfastapi==0.141.0\n",
        "ilova/server.py": b"# API kodi\n" + b"x = 1\n" * 400,
        "ilova/model.py": b"# model yuklash\n" + b"y = 2\n" * 300,
        "README.md": b"# Loyiha\n",
        "tests/test_api.py": b"def test_ok():\n    assert True\n",
    }


def mos_fayllar(fayllar, manba):
    if manba == ".":
        return sorted(fayllar)
    if manba.endswith("/"):
        return sorted(f for f in fayllar if f.startswith(manba))
    return [manba]


def qur(qadamlar, fayllar):
    """Har qatlam kaliti = xesh(ota kalit + ko'rsatma + nusxalangan fayllar)."""
    qatlamlar, ota = [], ""
    for q in qadamlar:
        h = hashlib.sha256((ota + q.buyruq + " " + q.argument).encode())
        hajm, soniya = FARAZIY[q.buyruq]
        if q.buyruq == "COPY":
            nomlar = mos_fayllar(fayllar, q.argument)
            for nom in nomlar:
                h.update(nom.encode() + hashlib.sha256(fayllar[nom]).digest())
            hajm = sum(len(fayllar[n]) for n in nomlar) / 1e6
        kalit = h.hexdigest()[:12]
        qatlamlar.append(Qatlam(q, kalit, hajm, soniya))
        ota = kalit
    return qatlamlar


def natija(qatlamlar, kesh, serverda):
    """Keshda yo'q qatlamlar quriladi; serverda yo'q qatlamlar yuklanadi."""
    qayta = [q for q in qatlamlar if q.kalit not in kesh]
    soniya = sum(q.soniya for q in qayta)
    yuklab = sum(q.hajm_mb for q in qatlamlar if q.kalit not in serverda)
    return qayta, soniya, yuklab


def main() -> None:
    tartiblar = {"yomon (COPY . . oldin)": YOMON_TARTIB,
                 "yaxshi (requirements oldin)": YAXSHI_TARTIB}

    print("=== 1. Kalit zanjiri (yaxshi tartib, birinchi qurish) ===")
    fayllar = boshlangich_fayllar()
    for q in qur(YAXSHI_TARTIB, fayllar):
        print(f"  {q.kalit}  {q.qadam.buyruq:<8} {q.qadam.argument[:34]:<34} "
              f"{q.hajm_mb:>8.3f} MB")
    print("  FROM qatlami mashinada bor (bir marta tortilgan) deb olamiz")

    ssenariylar = [
        ("hech narsa o'zgarmadi", lambda f: None),
        ("ilova/model.py o'zgardi",
         lambda f: f.__setitem__("ilova/model.py", f["ilova/model.py"] + b"#")),
        ("README.md o'zgardi",
         lambda f: f.__setitem__("README.md", b"# Loyiha v2\n")),
        ("requirements.txt o'zgardi",
         lambda f: f.__setitem__("requirements.txt",
                                 f["requirements.txt"] + b"joblib==1.5.1\n")),
    ]

    print("\n=== 2. Bitta o'zgarish: nima qayta quriladi ===")
    print(f"  {'ssenariy':<26} {'tartib':<28} {'qayta':>5} "
          f"{'soniya':>6} {'yuklab MB':>9}")
    for nom, ozgartir in ssenariylar:
        for t_nom, qadamlar in tartiblar.items():
            asl = qur(qadamlar, boshlangich_fayllar())
            kesh = {q.kalit for q in asl}
            yangi_fayllar = boshlangich_fayllar()
            ozgartir(yangi_fayllar)
            qayta, soniya, yuklab = natija(qur(qadamlar, yangi_fayllar),
                                           kesh, kesh)
            belgilar = ",".join(q.qadam.buyruq for q in qayta) or "-"
            print(f"  {nom:<26} {t_nom:<28} {len(qayta):>5} {soniya:>6.0f} "
                  f"{yuklab:>9.3f}  [{belgilar}]")

    print("\n=== 3. 40 ta commit tarixi (urug' 7) ===")
    rng = random.Random(7)
    turlar = rng.choices(["kod", "hujjat", "bogliqlik"],
                         weights=[0.80, 0.12, 0.08], k=40)
    print(f"  commitlar: kod {turlar.count('kod')}, hujjat "
          f"{turlar.count('hujjat')}, bogliqlik {turlar.count('bogliqlik')}")
    jami = {}
    for t_nom, qadamlar in tartiblar.items():
        f = boshlangich_fayllar()
        oldingi = qur(qadamlar, f)
        kesh = {q.kalit for q in oldingi}
        soniyalar, yuklamalar = [], []
        for i, tur in enumerate(turlar):
            if tur == "kod":
                f["ilova/server.py"] += f"# o'zgarish {i}\n".encode()
            elif tur == "hujjat":
                f["README.md"] += f"qator {i}\n".encode()
            else:
                f["requirements.txt"] += f"paket{i}==1.0\n".encode()
            qatlamlar = qur(qadamlar, f)
            _, soniya, yuklab = natija(qatlamlar, kesh, kesh)
            kesh |= {q.kalit for q in qatlamlar}
            soniyalar.append(soniya)
            yuklamalar.append(yuklab)
        jami[t_nom] = (np.array(soniyalar), np.array(yuklamalar))
        print(f"  {t_nom:<28} qurish {sum(soniyalar):>6.0f} s, "
              f"serverga yuklab {sum(yuklamalar):>8.1f} MB")

    print("\n=== 4. Juftlashgan farq (bir xil commitlar, yomon - yaxshi) ===")
    (s_y, m_y), (s_x, m_x) = jami.values()
    for nom, a, b in [("soniya", s_y, s_x), ("MB", m_y, m_x)]:
        d = a - b
        se = d.std(ddof=1) / np.sqrt(len(d))
        belgi = "sezilarli" if abs(d.mean()) > 2 * se else "sezilarsiz"
        print(f"  {nom:<7} o'rtacha farq {d.mean():>8.2f} +- {se:.2f} (SE) "
              f"-> {belgi}")
    ulush = (m_y.sum() - m_x.sum()) / m_y.sum()
    print(f"  yaxshi tartib yuklamani {ulush:.1%} ga kamaytirdi")

    print("\n=== 5. Tuzoq: RUN kaliti natijaga emas, MATNGA bog'liq ===")
    pinsiz = [Qadam("FROM", "python:3.12.7-slim"),
              Qadam("RUN", "pip install --no-cache-dir pandas")]
    k1 = qur(pinsiz, {})[-1].kalit
    k2 = qur(pinsiz, {})[-1].kalit
    print(f"  dushanba kaliti: {k1}, juma kaliti: {k2}, teng: {k1 == k2}")
    print("  PyPI da yangi pandas chiqsa ham kesh ESKI qatlamni beradi;")
    print("  keshsiz mashinada esa YANGI versiya o'rnatiladi -> ikki xil image")
    print("  yechim: versiyani pinlash (pandas==3.0.0) - matn = natija")
    print("  ⭐ Kam o'zgaradigan narsa tepada, tez o'zgaradigani pastda")


if __name__ == "__main__":
    main()

=== 1. Kalit zanjiri (yaxshi tartib, birinchi qurish) ===
  bd146a98f1e6  FROM     python:3.12.7-slim                   45.000 MB
  53d9795bc465  WORKDIR  /app                                  0.000 MB
  526fe4126d81  COPY     requirements.txt                      0.000 MB
  7c223b978278  RUN      pip install --no-cache-dir -r requ  380.000 MB
  907aea1d3374  COPY     ilova/                                0.004 MB
  7e4900179101  CMD      ["python", "-m", "ilova.server"]      0.000 MB
  FROM qatlami mashinada bor (bir marta tortilgan) deb olamiz

=== 2. Bitta o'zgarish: nima qayta quriladi ===
  ssenariy                   tartib                       qayta soniya yuklab MB
  hech narsa o'zgarmadi      yomon (COPY . . oldin)           0      0     0.000  [-]
  hech narsa o'zgarmadi      yaxshi (requirements oldin)      0      0     0.000  [-]
  ilova/model.py o'zgardi    yomon (COPY . . oldin)           3     96   380.004  [COPY,RUN,CMD]
  ilova/model.py o'zgardi    yaxshi (requirements oldin)      2      1     0.004  [COPY,CMD]
  README.md o'zgardi         yomon (COPY . . oldin)           3     96   380.004  [COPY,RUN,CMD]
  README.md o'zgardi         yaxshi (requirements oldin)      0      0     0.000  [-]
  requirements.txt o'zgardi  yomon (COPY . . oldin)           3     96   380.004  [COPY,RUN,CMD]
  requirements.txt o'zgardi  yaxshi (requirements oldin)      4     97   380.004  [COPY,RUN,COPY,CMD]

=== 3. 40 ta commit tarixi (urug' 7) ===
  commitlar: kod 35, hujjat 3, bogliqlik 2
  yomon (COPY . . oldin)       qurish   3840 s, serverga yuklab  15200.2 MB
  yaxshi (requirements oldin)  qurish    229 s, serverga yuklab    760.2 MB

=== 4. Juftlashgan farq (bir xil commitlar, yomon - yaxshi) ===
  soniya  o'rtacha farq    90.28 +- 3.35 (SE) -> sezilarli
  MB      o'rtacha farq   361.00 +- 13.26 (SE) -> sezilarli
  yaxshi tartib yuklamani 95.0% ga kamaytirdi

=== 5. Tuzoq: RUN kaliti natijaga emas, MATNGA bog'liq ===
  dushanba kaliti: a156ecc6a623, juma kaliti: a156ecc6a623, teng: True
  PyPI da yangi pandas chiqsa ham kesh ESKI qatlamni beradi;
  keshsiz mashinada esa YANGI versiya o'rnatiladi -> ikki xil image
  yechim: versiyani pinlash (pandas==3.0.0) - matn = natija
  ⭐ Kam o'zgaradigan narsa tepada, tez o'zgaradigani pastda

""".dockerignore ta'siri: haqiqiy vaqtinchalik papkada build kontekst hajmi."""

import hashlib
import random
import re
import tempfile
from pathlib import Path

LOYIHA = {                      # nisbiy yo'l -> hajm (bayt)
    "Dockerfile": 600,
    "requirements.txt": 120,
    "ilova/__init__.py": 0,
    "ilova/server.py": 4_000,
    "ilova/model.py": 3_000,
    "artefakt/model.joblib": 1_500_000,
    "data/raw/buyurtmalar_2025.csv": 6_000_000,
    "data/raw/buyurtmalar_2026.csv": 5_000_000,
    "data/schema.json": 800,
    "notebooks/eda.ipynb": 900_000,
    ".git/objects/pack/pack-1.pack": 3_500_000,
    ".git/HEAD": 30,
    ".venv/lib/site-packages/numpy/core.so": 2_500_000,
    "ilova/__pycache__/server.cpython-312.pyc": 9_000,
    "tests/test_api.py": 1_500,
    ".env": 90,
    "README.md": 700,
}

ZAIF_IGNORE = """\
.git
"""

YAXSHI_IGNORE = """\
# versiya nazorati va muhit
.git
.venv
**/__pycache__
**/*.pyc
# sirlar - HECH QACHON kontekstga
.env
.env.*
# katta ma'lumot va tahlil
data/
!data/schema.json
notebooks/
tests/
README.md
"""


def naqsh_regex(naqsh):
    """Soddalashtirilgan Docker qoidasi: ** - istalgan chuqurlik, * - bitta
    bo'lak ichida, naqsh papkaga mos kelsa - uning ichidagi hamma narsa."""
    naqsh = naqsh.strip("/")
    r, i = "", 0
    while i < len(naqsh):
        if naqsh.startswith("**/", i):
            r += "(?:.*/)?"
            i += 3
        elif naqsh.startswith("**", i):
            r += ".*"
            i += 2
        elif naqsh[i] == "*":
            r += "[^/]*"
            i += 1
        elif naqsh[i] == "?":
            r += "[^/]"
            i += 1
        else:
            r += re.escape(naqsh[i])
            i += 1
    return re.compile(r + "(?:/.*)?")


def qoidalar(matn):
    natija = []
    for qator in matn.splitlines():
        qator = qator.strip()
        if not qator or qator.startswith("#"):
            continue
        inkor = qator.startswith("!")
        natija.append((inkor, naqsh_regex(qator.lstrip("!"))))
    return natija


def chiqarilganmi(nisbiy, qoida_royxati):
    """Oxirgi mos kelgan qoida g'olib (Docker ham shunday)."""
    holat = False
    for inkor, rx in qoida_royxati:
        if rx.fullmatch(nisbiy):
            holat = not inkor
    return holat


def kontekst(ildiz, ignore_matni):
    q = qoidalar(ignore_matni) if ignore_matni else []
    fayllar = []
    for yol in ildiz.rglob("*"):
        if yol.is_file():
            nisbiy = yol.relative_to(ildiz).as_posix()
            if nisbiy == ".dockerignore":
                continue
            if not chiqarilganmi(nisbiy, q):
                fayllar.append(nisbiy)
    return sorted(fayllar)          # OS tartibiga tayanmaymiz


def kontekst_xeshi(ildiz, fayllar):
    h = hashlib.sha256()
    for nisbiy in fayllar:
        h.update(nisbiy.encode() + (ildiz / nisbiy).read_bytes())
    return h.hexdigest()[:12]


def main() -> None:
    rng = random.Random(0)
    with tempfile.TemporaryDirectory(prefix="kontekst_") as papka:
        ildiz = Path(papka)
        for nisbiy, hajm in LOYIHA.items():
            yol = ildiz / nisbiy
            yol.parent.mkdir(parents=True, exist_ok=True)
            if nisbiy == ".env":
                matn = "DB_URL=postgresql://ilova:SINOV-QIYMAT@db:5432/ml\n"
                yol.write_text(matn, encoding="utf-8")
            else:
                yol.write_bytes(rng.randbytes(hajm))

        print("=== 1. Loyiha papkasi (haqiqiy fayllar) ===")
        jami = sum(p.stat().st_size for p in ildiz.rglob("*") if p.is_file())
        print(f"  fayllar: {sum(1 for p in ildiz.rglob('*') if p.is_file())}, "
              f"jami {jami / 1e6:.2f} MB")

        variantlar = {"ignore yo'q": "", "faqat .git": ZAIF_IGNORE,
                      "yaxshi .dockerignore": YAXSHI_IGNORE}
        print("\n=== 2. Build kontekst: docker build . nima yuboradi ===")
        print(f"  {'variant':<22} {'fayl':>4} {'MB':>7} {'.env':>6} "
              f"{'.git':>6} {'data':>6}")
        natijalar = {}
        for nom, matn in variantlar.items():
            f = kontekst(ildiz, matn)
            mb = sum((ildiz / n).stat().st_size for n in f) / 1e6
            natijalar[nom] = f
            env = "BOR" if ".env" in f else "yo'q"
            git = "BOR" if any(n.startswith(".git/") for n in f) else "yo'q"
            data = sum(n.startswith("data/") for n in f)
            print(f"  {nom:<22} {len(f):>4} {mb:>7.2f} {env:>6} {git:>6} "
                  f"{data:>6}")

        print("\n=== 3. Xavfsizlik tekshiruvi ===")
        for nom, f in natijalar.items():
            xavfli = [n for n in f if n == ".env" or n.startswith(".env.")]
            if xavfli:
                print(f"  {nom:<22} XAVF: {', '.join(xavfli)} kontekstda - "
                      f"COPY . . uni image ga yozadi")
            else:
                print(f"  {nom:<22} sir fayllar kontekstda yo'q")

        print("\n=== 4. Yaxshi ignore: nima qoldi ===")
        for n in natijalar["yaxshi .dockerignore"]:
            print(f"  {n}")
        print("  data/ chiqarildi, lekin !data/schema.json qaytarildi")

        print("\n=== 5. Kesh bilan bog'liqligi: noutbuk o'zgardi ===")
        oldin = {k: kontekst_xeshi(ildiz, f) for k, f in natijalar.items()}
        nb = ildiz / "notebooks" / "eda.ipynb"
        nb.write_bytes(nb.read_bytes() + b"yangi katak")
        for nom in variantlar:
            f = kontekst(ildiz, variantlar[nom])
            keyin = kontekst_xeshi(ildiz, f)
            holat = ("o'zgardi -> COPY . . keshi buziladi" if keyin != oldin[nom]
                     else "o'zgarmadi -> kesh saqlanadi")
            print(f"  {nom:<22} {oldin[nom]} -> {keyin}  {holat}")

        print("\n=== 6. Qoida tartibi muhim: oxirgi mos kelgan g'olib ===")
        for matn in ["data/\n!data/schema.json\n", "!data/schema.json\ndata/\n"]:
            q = qoidalar(matn)
            kirdi = not chiqarilganmi("data/schema.json", q)
            print(f"  {matn.replace(chr(10), ' | '):<34} schema.json "
                  f"{'kontekstda' if kirdi else 'chiqarildi'}")
        print("  ⭐ .dockerignore - tezlik VA xavfsizlik: .env hech qachon kirmasin")


if __name__ == "__main__":
    main()

=== 1. Loyiha papkasi (haqiqiy fayllar) ===
  fayllar: 17, jami 19.42 MB

=== 2. Build kontekst: docker build . nima yuboradi ===
  variant                fayl      MB   .env   .git   data
  ignore yo'q              17   19.42    BOR    BOR      3
  faqat .git               15   15.92    BOR   yo'q      3
  yaxshi .dockerignore      7    1.51   yo'q   yo'q      1

=== 3. Xavfsizlik tekshiruvi ===
  ignore yo'q            XAVF: .env kontekstda - COPY . . uni image ga yozadi
  faqat .git             XAVF: .env kontekstda - COPY . . uni image ga yozadi
  yaxshi .dockerignore   sir fayllar kontekstda yo'q

=== 4. Yaxshi ignore: nima qoldi ===
  Dockerfile
  artefakt/model.joblib
  data/schema.json
  ilova/__init__.py
  ilova/model.py
  ilova/server.py
  requirements.txt
  data/ chiqarildi, lekin !data/schema.json qaytarildi

=== 5. Kesh bilan bog'liqligi: noutbuk o'zgardi ===
  ignore yo'q            37667f1d3b98 -> 0d98e8eb478f  o'zgardi -> COPY . . keshi buziladi
  faqat .git             c155b77f32fe -> c5575fbeec36  o'zgardi -> COPY . . keshi buziladi
  yaxshi .dockerignore   8901076740f7 -> 8901076740f7  o'zgarmadi -> kesh saqlanadi

=== 6. Qoida tartibi muhim: oxirgi mos kelgan g'olib ===
  data/ | !data/schema.json |        schema.json kontekstda
  !data/schema.json | data/ |        schema.json chiqarildi
  ⭐ .dockerignore - tezlik VA xavfsizlik: .env hech qachon kirmasin

"""12-factor konfiguratsiya: env -> pydantic, validatsiya, sirni niqoblash."""

import logging
import os
import sys
from contextlib import contextmanager
from typing import Literal

from pydantic import (BaseModel, ConfigDict, Field, SecretStr, ValidationError,
                      model_validator)

PREFIKS = "ILOVA_"


class Sozlamalar(BaseModel):
    model_config = ConfigDict(frozen=True, extra="forbid")

    muhit: Literal["dev", "staging", "prod"]
    port: int = Field(8000, ge=1, le=65535)
    ishchilar: int = Field(2, ge=1, le=32)
    model_yoli: str
    chegara: float = Field(0.5, gt=0, lt=1)
    log_darajasi: Literal["DEBUG", "INFO", "WARNING", "ERROR"] = "INFO"
    db_url: SecretStr
    api_kalit: SecretStr

    @model_validator(mode="after")
    def prod_qoidalari(self):
        if self.muhit == "prod" and self.log_darajasi == "DEBUG":
            raise ValueError("prod da DEBUG log taqiqlangan (sirlar oqishi)")
        return self


def env_dan_yukla(env=None):
    """ILOVA_* o'zgaruvchilarini yig'ib, pydantic ga beradi."""
    env = os.environ if env is None else env
    xom = {k[len(PREFIKS):].lower(): v for k, v in env.items()
           if k.startswith(PREFIKS)}
    return Sozlamalar.model_validate(xom)


@contextmanager
def vaqtincha_env(**qiymatlar):
    """os.environ ni vaqtincha o'zgartiradi va ALBATTA qaytaradi."""
    eski = {k: os.environ.get(k) for k in qiymatlar}
    try:
        for k, v in qiymatlar.items():
            if v is None:
                os.environ.pop(k, None)
            else:
                os.environ[k] = v
        yield
    finally:
        for k, v in eski.items():
            if v is None:
                os.environ.pop(k, None)
            else:
                os.environ[k] = v


class SirNiqobi(logging.Filter):
    """Log xabarida uchragan har qanday sir qiymatini *** ga almashtiradi."""

    def __init__(self, sirlar):
        super().__init__()
        self.sirlar = [s for s in sirlar if s]

    def filter(self, yozuv):
        xabar = yozuv.getMessage()
        for s in self.sirlar:
            xabar = xabar.replace(s, "***")
        yozuv.msg, yozuv.args = xabar, None
        return True


def xatolarni_chiqar(xato):
    for e in xato.errors():
        joy = ".".join(str(x) for x in e["loc"])
        nom = PREFIKS + joy.upper() if joy else "(butun model)"
        print(f"    {nom}: {e['type']} - {e['msg'][:62].rstrip()}")


def main() -> None:
    # SINOV qiymatlari - haqiqiy sir emas; haqiqiy tizimda ular
    # orkestrator/secret manager tomonidan env ga qo'yiladi
    sinov_parol = "sinov-parol-" + "x7"
    sinov_kalit = "sk-sinov-" + "0" * 8
    asos = {
        "ILOVA_MUHIT": "prod",
        "ILOVA_PORT": "8080",
        "ILOVA_MODEL_YOLI": "/models/churn/v3/model.joblib",
        "ILOVA_DB_URL": f"postgresql://ilova:{sinov_parol}@db:5432/ml",
        "ILOVA_API_KALIT": sinov_kalit,
        "PATH_BOSHQA": "bu o'zgaruvchi e'tiborga olinmaydi",
    }

    print("=== 1. To'g'ri konfiguratsiya (env satrlari -> turlar) ===")
    s = env_dan_yukla(asos)
    print(f"  port: {s.port!r} ({type(s.port).__name__}), "
          f"chegara: {s.chegara}, ishchilar: {s.ishchilar} (sukut)")
    print(f"  repr: {str(s)[:74]}")
    print(f"  db_url repr: {s.db_url!r}")

    print("\n=== 2. Noto'g'ri konfiguratsiya - ishga tushishda darhol xato ===")
    holatlar = {
        "API kalit berilmagan": {"ILOVA_API_KALIT": None},
        "port matn": {"ILOVA_PORT": "sakkiz ming"},
        "port oraliqdan tashqari": {"ILOVA_PORT": "70000"},
        "muhit imlo xatosi": {"ILOVA_MUHIT": "production"},
        "o'zgaruvchi nomida xato": {"ILOVA_CHEGRA": "0.7"},
        "prod + DEBUG": {"ILOVA_LOG_DARAJASI": "DEBUG"},
    }
    for nom, ozgarish in holatlar.items():
        env = {**asos, **ozgarish}
        env = {k: v for k, v in env.items() if v is not None}
        try:
            env_dan_yukla(env)
            print(f"  {nom}: qabul qilindi (kutilmagan)")
        except ValidationError as xato:
            print(f"  {nom}: {xato.error_count()} xato")
            xatolarni_chiqar(xato)

    print("\n=== 3. Haqiqiy os.environ bilan, vaqtincha ===")
    oldin = {k: os.environ.get(k) for k in asos}
    with vaqtincha_env(**asos):
        s2 = env_dan_yukla()
        print(f"  ichkarida: muhit={s2.muhit}, port={s2.port}")
    qaytdi = all(os.environ.get(k) == v for k, v in oldin.items())
    print(f"  chiqqandan keyin os.environ asl holatida: {qaytdi}")

    print("\n=== 4. Sirni loglarda niqoblash ===")
    log = logging.getLogger("ilova")
    log.setLevel(logging.INFO)
    log.propagate = False
    ishlovchi = logging.StreamHandler(sys.stdout)
    ishlovchi.setFormatter(logging.Formatter("  %(levelname)s %(message)s"))
    log.addHandler(ishlovchi)
    print("  niqobsiz (xavfli):")
    log.info("DB ga ulanish: %s", s.db_url.get_secret_value())
    niqob = SirNiqobi([s.db_url.get_secret_value(),
                       s.api_kalit.get_secret_value(), sinov_parol])
    ishlovchi.addFilter(niqob)
    print("  niqob bilan:")
    log.info("DB ga ulanish: %s", s.db_url.get_secret_value())
    log.info("parol alohida chiqsa ham: %s", sinov_parol)
    log.info("sozlamalar: %s", s.model_dump_json(include={"muhit", "db_url"}))
    log.removeHandler(ishlovchi)

    print("\n=== 5. Bitta image, uch muhit ===")
    muhitlar = {
        "dev": {"ILOVA_MUHIT": "dev", "ILOVA_LOG_DARAJASI": "DEBUG",
                "ILOVA_ISHCHILAR": "1"},
        "staging": {"ILOVA_MUHIT": "staging", "ILOVA_ISHCHILAR": "2"},
        "prod": {"ILOVA_MUHIT": "prod", "ILOVA_ISHCHILAR": "8"},
    }
    for nom, ozgarish in muhitlar.items():
        m = env_dan_yukla({**asos, **ozgarish})
        print(f"  {nom:<8} log={m.log_darajasi:<5} ishchilar={m.ishchilar} "
              f"port={m.port}")
    print("  kod va image bir xil - faqat env farq qiladi")
    print("  ⭐ Konfiguratsiya - env da, validatsiya - ishga tushishda, "
          "sir - hech qachon logda")


if __name__ == "__main__":
    main()

=== 1. To'g'ri konfiguratsiya (env satrlari -> turlar) ===
  port: 8080 (int), chegara: 0.5, ishchilar: 2 (sukut)
  repr: muhit='prod' port=8080 ishchilar=2 model_yoli='/models/churn/v3/model.jobl
  db_url repr: SecretStr('**********')

=== 2. Noto'g'ri konfiguratsiya - ishga tushishda darhol xato ===
  API kalit berilmagan: 1 xato
    ILOVA_API_KALIT: missing - Field required
  port matn: 1 xato
    ILOVA_PORT: int_parsing - Input should be a valid integer, unable to parse string as an
  port oraliqdan tashqari: 1 xato
    ILOVA_PORT: less_than_equal - Input should be less than or equal to 65535
  muhit imlo xatosi: 1 xato
    ILOVA_MUHIT: literal_error - Input should be 'dev', 'staging' or 'prod'
  o'zgaruvchi nomida xato: 1 xato
    ILOVA_CHEGRA: extra_forbidden - Extra inputs are not permitted
  prod + DEBUG: 1 xato
    (butun model): value_error - Value error, prod da DEBUG log taqiqlangan (sirlar oqishi)

=== 3. Haqiqiy os.environ bilan, vaqtincha ===
  ichkarida: muhit=prod, port=8080
  chiqqandan keyin os.environ asl holatida: True

=== 4. Sirni loglarda niqoblash ===
  niqobsiz (xavfli):
  INFO DB ga ulanish: postgresql://ilova:sinov-parol-x7@db:5432/ml
  niqob bilan:
  INFO DB ga ulanish: ***
  INFO parol alohida chiqsa ham: ***
  INFO sozlamalar: {"muhit":"prod","db_url":"**********"}

=== 5. Bitta image, uch muhit ===
  dev      log=DEBUG ishchilar=1 port=8080
  staging  log=INFO  ishchilar=2 port=8080
  prod     log=INFO  ishchilar=8 port=8080
  kod va image bir xil - faqat env farq qiladi
  ⭐ Konfiguratsiya - env da, validatsiya - ishga tushishda, sir - hech qachon logda

FROM python:latest                                   # ⚠️
FROM python:3.12.7-slim                              # ✅ (yoki @sha256:... digest)

COPY . .                                             # ⚠️ har commit da pip qayta
RUN pip install -r requirements.txt

COPY requirements.txt .                              # ✅
RUN pip install --no-cache-dir -r requirements.txt
COPY ilova/ ./ilova/

RUN apt-get update && apt-get install -y gcc         # ⚠️
RUN rm -rf /var/lib/apt/lists/*                      #    kesh oldingi qatlamda qoldi

RUN apt-get update && \
    apt-get install -y --no-install-recommends gcc && \
    rm -rf /var/lib/apt/lists/*                      # ✅ bitta RUN ichida

ENV API_KALIT=sk-...                                 # ⚠️
COPY .env /app/.env                                  # ⚠️
# ✅ Dockerfile da sir YO'Q; ishga tushishda:
#    docker run --env-file .env ... yoki orkestrator secret

CMD ["python", "-m", "ilova.server"]                 # ⚠️ USER yo'q -> root

RUN useradd --create-home --uid 10001 ilova          # ✅
USER ilova
CMD ["python", "-m", "ilova.server"]

CMD python -m ilova.server                           # ⚠️ PID 1 = sh
CMD ["python", "-m", "ilova.server"]                 # ✅ SIGTERM ilovaga

port = int(os.environ.get("PORT", 8000))             # ⚠️ "PROT" imlo xatosi jim
chegara = os.environ.get("CHEGARA")                  # ⚠️ None yoki satr

sozlamalar = env_dan_yukla()                         # ✅ pydantic, extra="forbid"

docker build .     # ⚠️ .git, .venv, data/, .env -> kontekstga
# ✅ .dockerignore: .git .venv .env .env.* data/ notebooks/ **/__pycache__

1.  Konteyner va VM ning asosiy farqi nima?
2.  Image va konteyner farqi?
3.  Teg va digest farqi?
4.  Nima uchun requirements.txt koddan oldin nusxalanadi?
5.  RUN qatlamining kesh kaliti nimaga bog'liq?
6.  Multi-stage build nima beradi?
7.  Nima uchun ML uchun alpine ko'pincha yomon tanlov?
8.  RUN rm .env sirni o'chiradimi?
9.  EXPOSE portni ochadimi?
10. CMD ning shell shakli nima uchun xavfli?
11. .dockerignore nimaga ta'sir qiladi (uch narsa)?
12. extra="forbid" nima uchun kerak?

FROM python
ENV HF_TOKEN=hf_abc123
COPY . /app
WORKDIR /app
RUN apt-get update
RUN apt-get install -y build-essential
RUN pip install -r requirements.txt
RUN pip install torch
CMD python serve.py