# ---- Base image -----------------------------------------------------------
FROM python:3.11-slim AS base

# Prevent .pyc files & enable unbuffered logging (important for container logs)
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PORT=8080

WORKDIR /app

# ---- Install dependencies first (better layer caching) --------------------
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ---- Copy application code -------------------------------------------------
COPY app/ ./app/

# ---- Run as a non-root user (security best practice) -----------------------
RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
USER appuser

EXPOSE 8080

# ---- Container-level health check -----------------------------------------
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request,sys; \
    sys.exit(0) if urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3).status == 200 else sys.exit(1)"

# ---- Production WSGI server -------------------------------------------------
CMD ["gunicorn", "--bind", "0.0.0.0:8080", "--workers", "2", "--threads", "4", "--timeout", "30", "app.main:app"]