# syntax=docker/dockerfile:1

# Build stage: resolve dependencies into a wheel-installed prefix so the runtime
# image carries no build toolchain.
FROM python:3.12-slim AS build

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 PIP_NO_CACHE_DIR=1
WORKDIR /build

# The reference implementation is a real dependency of the service: validation is
# delegated to it so the service and the CLI cannot disagree about what a valid
# package is.
COPY reference/ ./reference/
COPY service/pyproject.toml ./service/
COPY service/src/ ./service/src/

RUN python -m venv /opt/venv \
 && /opt/venv/bin/pip install --no-cache-dir ./reference ./service

FROM python:3.12-slim AS runtime

# Non-root by default. The service writes nothing to disk; its state is the
# database.
RUN useradd --system --create-home --uid 10001 canned
ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

COPY --from=build /opt/venv /opt/venv
COPY service/alembic.ini /app/alembic.ini
COPY service/migrations/ /app/migrations/

WORKDIR /app
USER canned
EXPOSE 8000

# No CMD-embedded migration: schema changes are a deployment step with its own
# rollback, not something that races between replicas at start-up.
CMD ["uvicorn", "canned_prompts_service.api:create_app", "--factory", \
     "--host", "0.0.0.0", "--port", "8000"]