# Image of backend/: marimo notebooks, served read-only.
# Built from the root of the repo (compose.yaml, or podman build -f <directory>/Containerfile .).
# uv only, never pip; a non-root user ([HARDENED-CONTAINERS]).
FROM ghcr.io/astral-sh/uv:python3.14-trixie-slim@sha256:db955a4c5fd85c9e08ae2c02f3fcedf76765aebc7c9bc10c55a6bbcc1b0510be
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never PYTHONUNBUFFERED=1
WORKDIR /srv/backend
COPY backend/pyproject.toml backend/uv.lock backend/.python-version ./
RUN uv sync --locked --no-dev --no-install-project
COPY backend/ ./
RUN uv sync --locked --no-dev && useradd --system --create-home app && chown -R app /srv
# The image's environment first in PATH: the server starts without uv, which would want to
# write its cache into a read-only file system ([HARDENED-CONTAINERS]).
ENV PATH="/srv/backend/.venv/bin:$PATH"
USER app
EXPOSE 2718
CMD ["marimo", "run", "notebooks/exploration.py", "--host", "0.0.0.0", "--port", "2718"]
