# syntax=docker/dockerfile:1
#
# Packages the example outbox worker (examples/outbox_worker) as a standalone image for
# local container testing of the eventcommon publisher/consumer/outbox stack. This library
# itself ships as a wheel/sdist (see `make build`); this image is a runnable demonstration,
# not a production artifact of the library.

FROM python:3.14-slim AS builder

WORKDIR /src

COPY pyproject.toml README.md ./
COPY src ./src
COPY examples ./examples

RUN pip install --no-cache-dir --prefix=/install "."

FROM python:3.14-slim

# Pinning apt versions on python:3.14-slim is brittle: Debian's archive rotates old
# point-release versions out, breaking the build on every base image bump.
# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --no-create-home --shell /usr/sbin/nologin appuser

# The runtime image never invokes pip (dependencies are installed in the builder stage
# and copied in below) — strip it from the base image. pip vendors its own pinned
# copies of msgpack and setuptools for internal use (see pip/_vendor/vendor.txt), which
# lag behind upstream fixes and otherwise show up as HIGH-severity CVEs in image scans
# (Trivy) even though nothing at runtime ever imports them.
RUN PIP_PKG_DIR="$(python -c 'import pip, os; print(os.path.dirname(pip.__file__))')" \
    && rm -rf "$PIP_PKG_DIR" "$(dirname "$PIP_PKG_DIR")"/pip-*.dist-info \
    && rm -f /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.*

WORKDIR /app

ARG APP_NAME=eventcommon-outbox-worker-example
ARG BUILD_VERSION=unknown

COPY --from=builder /install /usr/local
COPY examples ./examples

ENV APP_NAME=${APP_NAME} \
    APP_ENV=prod \
    BUILD_VERSION=${BUILD_VERSION} \
    HEARTBEAT_PATH=/tmp/heartbeat \
    PYTHONUNBUFFERED=1

# The worker has no HTTP server — health is a heartbeat file touched every 10s by the
# main loop (see examples/outbox_worker/main.py). A stale or missing file means the
# process is hung or dead.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import pathlib,sys,time; p=pathlib.Path('${HEARTBEAT_PATH:-/tmp/heartbeat}'); sys.exit(0 if p.exists() and time.time()-p.stat().st_mtime < 30 else 1)"

USER appuser

ENTRYPOINT ["python", "-m", "examples.outbox_worker.main"]
