# syntax=docker/dockerfile:1.7

# Override these with digest-pinned references in release builds, for example:
#   --build-arg PYTHON_BUILD_IMAGE=python:3.12.11-slim-bookworm@sha256:...
#   --build-arg PYTHON_RUNTIME_IMAGE=python:3.12.11-slim-bookworm@sha256:...
ARG PYTHON_BUILD_IMAGE=python:3.12.11-slim-bookworm
ARG PYTHON_RUNTIME_IMAGE=python:3.12.11-slim-bookworm
ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.11.2

FROM ${UV_IMAGE} AS uv
FROM ${PYTHON_BUILD_IMAGE} AS build

ARG AVIARY_LOCK_SHA256=""
ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PROJECT_ENVIRONMENT=/opt/aviary-venv
WORKDIR /build

# uv.lock contains artifact hashes. AVIARY_LOCK_SHA256 is an optional release
# gate for pinning the complete lock file itself (see scripts/dependency-lock-sha256.sh).
COPY --from=uv /uv /uvx /bin/
COPY pyproject.toml uv.lock ./
RUN if [ -n "${AVIARY_LOCK_SHA256}" ]; then \
      printf '%s  %s\n' "${AVIARY_LOCK_SHA256}" uv.lock | sha256sum --check --strict -; \
    fi \
    && uv sync --frozen --no-dev --no-install-project

COPY README.md LICENSE ./
COPY src ./src
RUN uv sync --frozen --no-dev --no-editable \
    && find /opt/aviary-venv -type d -name __pycache__ -prune -exec rm -rf '{}' +

FROM ${PYTHON_RUNTIME_IMAGE} AS runtime

ARG APP_UID=10002
ARG APP_GID=10002
RUN groupadd --gid "${APP_GID}" aviary \
    && useradd --uid "${APP_UID}" --gid "${APP_GID}" \
      --home-dir /home/aviary --create-home --shell /usr/sbin/nologin aviary

ENV PATH=/opt/aviary-venv/bin:$PATH \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    AVIARY_HOST=0.0.0.0 \
    AVIARY_PORT=8000
WORKDIR /app

COPY --from=build /opt/aviary-venv /opt/aviary-venv
COPY --chown=aviary:aviary examples/container_app.py /app/server.py

USER aviary
EXPOSE 8000
HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=3 \
  CMD ["python", "-c", "import os,urllib.request; urllib.request.urlopen('http://127.0.0.1:'+os.getenv('AVIARY_PORT','8000')+'/birdz/ready', timeout=2).read()"]
CMD ["python", "/app/server.py"]
