# Candidate hardened base — musl/Alpine. Carries no perl, which is where the
# Debian variant's three unfixable CRITICALs live (CVE-2026-13221, -42496,
# -8376 in perl-base, no upstream fix as of 2026-09-06).
#
# Not yet the sanctioned base. See docs/image-scan-2026-09-06.md.

FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS build

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/opt/venv/bin:$PATH

RUN python -m venv /opt/venv

WORKDIR /app
COPY pyproject.toml README.md ./
COPY approval_engine ./approval_engine
RUN pip install --no-cache-dir '.[serve]' \
    && rm -rf /opt/venv/bin/pip /opt/venv/bin/pip3 /opt/venv/bin/pip3.12 \
              /opt/venv/lib/python3.12/site-packages/pip \
              /opt/venv/lib/python3.12/site-packages/pip-*.dist-info \
              /opt/venv/lib/python3.12/site-packages/setuptools \
              /opt/venv/lib/python3.12/site-packages/setuptools-*.dist-info \
              /opt/venv/lib/python3.12/site-packages/pkg_resources

FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH=/opt/venv/bin:$PATH

RUN addgroup -S -g 10001 approval \
    && adduser -S -u 10001 -G approval -H approval \
    && rm -rf /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
              /usr/local/lib/python3.12/site-packages/pip \
              /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
              /usr/local/lib/python3.12/site-packages/setuptools \
              /usr/local/lib/python3.12/site-packages/setuptools-*.dist-info \
              /usr/local/lib/python3.12/site-packages/pkg_resources

COPY --from=build /opt/venv /opt/venv

WORKDIR /app
USER 10001:10001
EXPOSE 8080
ENTRYPOINT ["approval-engine"]
CMD ["serve", "--help"]