FROM ghcr.io/astral-sh/uv:0.11.2 AS uv

FROM python:3.13-slim

COPY --from=uv /uv /uvx /bin/

RUN apt-get update \
    && apt-get install --yes --no-install-recommends ca-certificates ffmpeg \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --create-home --uid 10001 kve \
    && mkdir -p /app /tmp/kve/workspace /tmp/kve/artifacts \
    && chown -R kve:kve /app /tmp/kve

WORKDIR /app

ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    KVE_WORKSPACE_DIR=/tmp/kve/workspace \
    KVE_ARTIFACT_DIR=/tmp/kve/artifacts \
    KVE_ARTIFACT_BACKEND=aliyun_oss \
    KVE_ANALYSIS_OCR_PRIMARY=vision_llm

COPY pyproject.toml uv.lock README.md ./
COPY src ./src

# The REST image installs only the frozen public registry graph. The upstream
# ShortVideo adapter remains an optional package boundary and is omitted here.
RUN uv sync --frozen --no-default-groups --extra rest --no-editable

USER kve

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3)"]

CMD ["uvicorn", "keble_video_enrichment.rest.runtime:create_production_app", "--factory", "--host", "0.0.0.0", "--port", "8000"]
