refactor: usar imagem oficial litellm/litellm como base

- Menor tamanho final (não reinstala litellm)
- Atualizações de segurança seguem a imagem oficial
- Só instala numpy + scikit-learn como deps extras

Dockerfile

@@ -1,42 +1,63 @@
-# =============================================================================
-# Tool Router + LiteLLM Proxy
-# =============================================================================
-# Build:  docker build -t tool-router-litellm .
-# Run:    docker run --rm -p 4000:4000 --env-file .env tool-router-litellm
-# =============================================================================
+# ---------------------------------------------------------------
+# Docker image for the Tool Router (based on the official LiteLLM image)
+# ---------------------------------------------------------------
+# Why use the official base?
+# • It already contains the core LiteLLM binaries and entrypoint
+# • Smaller image size (no extra OS packages we don’t need)
+# • Keeps the same security update cadence as the official image
+#
+# What we add:
+#   • Our Tool Router source code (tool_router_logger.py, config.yaml, etc.)
+#   • Extra Python dependencies required for the Jaccard/Embedding logic
+#       – numpy
+#       – scikit‑learn
+#   • A tiny wrapper entrypoint that runs `litellm --config /app/config.yaml`
+# ---------------------------------------------------------------
 
-FROM python:3.12-slim
+# 1️⃣  Use the official LiteLLM image (based on python:3.12‑slim)
+FROM litellm/litellm:latest AS base
 
-ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1 \
-    PYTHONPATH=/app \
-    PORT=4000
+# 2️⃣  Set environment variables that control the router
+ENV \
+  # Port the proxy will expose (match docker‑compose)
+  PORT=4000 \
+  # Router defaults – can be overridden at runtime with env vars
+  TOOL_ROUTER_SIMILARITY_MODE=jaccard \
+  TOOL_ROUTER_TOP_K=3 \
+  TOOL_ROUTER_MIN_SIMILARITY=0.15 \
+  TOOL_ROUTER_ALWAYS_INCLUDE=get_time,help,list_tools \
+  TOOL_ROUTER_EMBEDDING_MODEL=text-embedding-3-small
 
+# 3️⃣  Create a non‑root user (optional but recommended)
+RUN useradd -m litellm && \
+    mkdir -p /app && \
+    chown litellm:litellm /app
+
+# 4️⃣  Switch to that user for the rest of the steps
+USER litellm
 WORKDIR /app
 
-# Dependências de sistema mínimas (certs para HTTPS das APIs LLM)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates \
-        curl \
-    && rm -rf /var/lib/apt/lists/*
+# 5️⃣  Copy only the files that belong to the Tool Router
+#    (keeps the image lean – we don’t copy .git, docs, etc.)
+COPY --chown=litellm:litellm \
+    tool_router_logger.py \
+    config.yaml \
+    test_tool_router.py \
+    requirements.txt \
+    ./
 
-# requirements.txt instala litellm + numpy + scikit-learn
-# (litellm NÃO traz numpy/sklearn por padrão)
-COPY requirements.txt .
-RUN pip install --upgrade pip && pip install -r requirements.txt
+# 6️⃣  Install the extra Python deps that the router needs:
+#       – numpy   (for cosine similarity)
+#       – scikit‑learn (for the Jaccard fallback)
+RUN pip install --no-cache-dir -r requirements.txt
 
-# Código do router + configs
-COPY tool_router_logger.py .
-COPY config.yaml .
-COPY test_tool_router.py .
-
-# Porta do proxy
+# 7️⃣  Expose the port used by LiteLLM
 EXPOSE 4000
 
-# Healthcheck simples no endpoint do proxy
+# 8️⃣  Healthcheck – LiteLLM returns a JSON “health” endpoint
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
   CMD curl -fsS "http://127.0.0.1:${PORT}/health" || exit 1
 
-# Variáveis TOOL_ROUTER_* e OPENAI_API_KEY / LITELLM_MASTER_KEY vêm do runtime
-CMD ["sh", "-c", "litellm --config /app/config.yaml --port ${PORT} --host 0.0.0.0"]
+# 9️⃣  Default command – run the proxy with our config file
+#     The official image’s entrypoint is preserved, we just pass the config.
+CMD ["sh", "-c", "litellm --config /app/config.yaml --port ${PORT} --host 0.0.0.0"]