Setup LangGraph Build with Private Repositories

When building Docker images for LangGraph agents that depend on private repositories (like JFrog Artifactory) and use uv as a package manager, there are several approaches you can take. Here's how to set it up properly:

Method 1: Using dockerfile_lines with uv sync (Recommended)

1. In your langgraph.json file, add dockerfile_lines to pre-install dependencies using uv sync:

   {
     "dependencies": ["."],
     "graphs": {"agent": "./agent.py:graph"},
     "dockerfile_lines": [
       "COPY . /tmp/project",
       "WORKDIR /tmp/project", 
       "RUN uv sync"
     ]
   }

2. This approach copies your project and runs uv sync before the auto-generated uv pip install command, ensuring your uv.lock file is respected

3. Build your image using: langgraph build -t my-image

Method 2: Using Build Arguments for Credentials

1. Add build-time environment variables in your langgraph.json:

   {
     "dependencies": ["."],
     "graphs": {"agent": "./agent.py:graph"},
     "dockerfile_lines": [
       "ARG UV_INDEX_URL",
       "ARG UV_EXTRA_INDEX_URL",
       "ENV UV_INDEX_URL=${UV_INDEX_URL}",
       "ENV UV_EXTRA_INDEX_URL=${UV_EXTRA_INDEX_URL}"
     ]
   }

2. Build with credentials passed as build arguments:

   langgraph build -t my-image -- --build-arg UV_INDEX_URL=https://your-jfrog.com/pypi/simple --build-arg UV_EXTRA_INDEX_URL=...

Method 3: Using Docker Secrets (For LangSmith Deployments)

1. Add environment variables to your deployment through the LangSmith UI

2. In your langgraph.json, use Docker secrets to access credentials at build time:

   {
     "dockerfile_lines": [
       "RUN --mount=type=secret,id=LANGCHAIN_SECRET,dst=/run/secrets/LANGCHAIN_SECRET "
     ]
   }

3. Deploy your application - the secret will be available during build without being stored in the final image

Manual Dockerfile Approach

1. Generate a base Dockerfile: langgraph dockerfile

2. Manually modify the generated Dockerfile to use uv sync instead of uv pip install

3. Add proper credential handling for your private repositories

4. Build using standard Docker commands

Usage

Current Limitations:

• The langgraph build CLI uses uv pip install --system which doesn't leverage uv.lock files

• The env parameter in langgraph.json only applies to runtime, not build time

• Build arguments may leave credentials in the final Docker image layers

Best Practices:

• Use Method 1 (dockerfile_lines with uv sync) for the most reliable builds that respect your lockfile

• Be careful with credential management - avoid logging or exporting secrets during build

• For LangSmith deployments with large environment variables (>4000 characters), contact support for build-time environment variable support

Note: Feature requests have been submitted to support native uv sync functionality and improved uv authentication handling in future releases.