# syntax=docker/dockerfile:1.7

FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \
    DATABASE_PATH=/app/data/bot.db \
    LOG_FILE=/app/logs/bot.log

# FFmpeg/ffprobe are optional diagnostics. Media itself is streamed directly
# to Telegram and never written to the container filesystem. gosu drops root
# after the entrypoint repairs ownership of mounted volumes.
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates ffmpeg gosu \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Chromium is optional at runtime (it is launched lazily only when an adapter or
# the generic fallback requests rendering). Delete this block when
# BROWSER_FALLBACK_ENABLED=false to reduce the image size.
RUN printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\n' \
        > /etc/apt/apt.conf.d/80-retries \
    && python -m playwright install --with-deps chromium \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

RUN groupadd --gid 10001 botuser \
    && useradd --uid 10001 --gid botuser --create-home --shell /usr/sbin/nologin botuser \
    && mkdir -p /app/data /app/logs \
    && chown -R botuser:botuser /app

COPY --chown=botuser:botuser app ./app
COPY --chown=root:root docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
RUN chmod 0755 /usr/local/bin/docker-entrypoint.sh \
    && chmod -R a+rX /ms-playwright

VOLUME ["/app/data", "/app/logs"]

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["python", "-m", "app.main"]
