FROM python:3.13-slim-bookworm@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_NO_CACHE=1 \
    UV_PYTHON_DOWNLOADS=never \
    ERRATA_DATA_DIR=/data

RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates libicu72 libgssapi-krb5-2 libstdc++6 libgcc-s1 libssl3 zlib1g \
    && rm -rf /var/lib/apt/lists/* \
    && python -m pip install --no-cache-dir uv==0.13.6 \
    && useradd --create-home --uid 10001 errata

WORKDIR /app
COPY pyproject.toml uv.lock README.md LICENSE ./
COPY errata_replay ./errata_replay
COPY static ./static
COPY fixtures ./fixtures
COPY models ./models
COPY firmware ./firmware
COPY tools ./tools
RUN uv sync --frozen --no-dev \
    && python tools/bootstrap_engine.py \
    && rm -rf .local/downloads \
    && mkdir -p /data \
    && chmod 700 /data \
    && chown -R 10001:10001 /app /data

USER 10001:10001
EXPOSE 8765
VOLUME ["/data"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
  CMD ["/app/.venv/bin/python", "-c", "import json,urllib.request; assert json.load(urllib.request.urlopen('http://127.0.0.1:8765/healthz',timeout=3))['status']=='ok'"]
ENTRYPOINT ["/app/tools/container-entrypoint.sh"]
