# Sanctioned base — musl/Alpine, adopted 2026-09-06.
#
# Alpine carries no perl, which is where the Debian slim variant's three
# unfixable CRITICALs lived (CVE-2026-13221, CVE-2026-42496, CVE-2026-8376 in
# perl-base, no upstream fix). Debian slim scanned 3 CRITICAL / 51 HIGH / 56
# MEDIUM against this image's 0 / 7 / 1.
#
# pip is deliberately absent from the runtime stage: it is a build-time tool,
# it held every Python-layer finding, and a running approval service has no
# business installing packages. Do not add it back.
#
# Base is pinned by digest, never a tag. See docs/image-scan-2026-09-06.md.

FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS build

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/opt/venv/bin:$PATH

RUN python -m venv /opt/venv

WORKDIR /app
COPY pyproject.toml README.md ./
COPY approval_engine ./approval_engine
RUN pip install --no-cache-dir '.[serve]' \
    && rm -rf /opt/venv/bin/pip /opt/venv/bin/pip3 /opt/venv/bin/pip3.12 \
              /opt/venv/lib/python3.12/site-packages/pip \
              /opt/venv/lib/python3.12/site-packages/pip-*.dist-info \
              /opt/venv/lib/python3.12/site-packages/setuptools \
              /opt/venv/lib/python3.12/site-packages/setuptools-*.dist-info \
              /opt/venv/lib/python3.12/site-packages/pkg_resources

FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/opt/venv/bin:$PATH

# libuuid is patched explicitly rather than left to the base's pinned version:
# the pinned Alpine 3.24.1 ships 2.42.1-r0, which carries every remaining HIGH
# finding, all fixed in 2.42.3. The floor is a minimum version, not a floating
# upgrade, so the build stays reproducible while refusing a vulnerable libuuid.
RUN apk add --no-cache 'libuuid>=2.42.3-r1' \
    && addgroup -S -g 10001 approval \
    && adduser -S -u 10001 -G approval -H approval \
    && rm -rf /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
              /usr/local/lib/python3.12/site-packages/pip \
              /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
              /usr/local/lib/python3.12/site-packages/setuptools \
              /usr/local/lib/python3.12/site-packages/setuptools-*.dist-info \
              /usr/local/lib/python3.12/site-packages/pkg_resources

COPY --from=build /opt/venv /opt/venv

WORKDIR /app
USER 10001:10001
EXPOSE 8080
ENTRYPOINT ["approval-engine"]
CMD ["serve", "--help"]