# syntax=docker/dockerfile:1
FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

WORKDIR /app

# A dedicated, unprivileged runtime account.
RUN groupadd --gid 10001 app \
    && useradd --uid 10001 --gid app --create-home --shell /usr/sbin/nologin app

COPY requirements.txt ./
RUN python -m pip install --no-cache-dir -r requirements.txt

COPY --chown=app:app . .
RUN mkdir -p /app/data /app/logs \
    && chown -R app:app /app/data /app/logs \
    && chmod +x /app/docker/entrypoint.sh

USER 10001:10001

ENTRYPOINT ["/app/docker/entrypoint.sh"]
CMD ["python", "-m", "app.main"]