FROM python:3.13-slim
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright
WORKDIR /app
COPY pyproject.toml LICENSE NOTICE ./
COPY LICENSES ./LICENSES
COPY src ./src
COPY docs/PYPI_DESCRIPTION.md ./docs/PYPI_DESCRIPTION.md
RUN pip install --no-cache-dir '.[browser]' \
    && python -m playwright install --with-deps chromium \
    && useradd --create-home --uid 10001 gft \
    && mkdir -p /downloads && chown gft:gft /downloads
USER 10001:10001
WORKDIR /downloads
ENTRYPOINT ["gft"]
CMD ["--help"]
# Sandbox remains enabled. Some container runtimes require user-namespace/seccomp
# configuration; never automatically add --no-sandbox as a fallback.
