# withcache cache-host. Build context is the repo root:
#   podman build -f deploy/Containerfile -t withcache .
# (deploy/compose.yml sets the context for you.)
FROM python:3.12-slim

# Install the package (no third-party deps) to get the withcache-server command.
# hatch_build.py is the wheel build hook (ships the shims); without it the build
# fails. No zig in this image, so the shims install as Python launchers, which
# is fine -- the container only runs withcache-server.
WORKDIR /app
COPY pyproject.toml README.md hatch_build.py /app/
COPY src /app/src
RUN pip install --no-cache-dir /app

# curl: HEALTHCHECK below. ``-f`` maps any 4xx/5xx to a non-zero
# exit without dumping a Traceback, matching the nbdmux sibling's
# Pass 5 pattern; if a future /healthz ever grows a non-200 branch
# (e.g. cache-disk-full check), no log-noise regression.
RUN apt-get update \
 && apt-get install -y --no-install-recommends curl \
 && rm -rf /var/lib/apt/lists/*

# Run as non-root; /data is the persistent volume for blobs + sqlite.
RUN useradd --create-home --uid 10001 app \
 && mkdir -p /data && chown app:app /data
USER app

EXPOSE 8081
VOLUME ["/data"]

# Set WITHCACHE_ADMIN_PASSWORD at run time to protect the operator UI.
# A session-signing key is persisted under /data automatically, or override
# with WITHCACHE_SESSION_SECRET.

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
  CMD curl -fsS -o /dev/null --max-time 2 http://127.0.0.1:8081/healthz || exit 1

ENTRYPOINT ["withcache-server", "--host", "0.0.0.0", "--port", "8081", "--data-dir", "/data"]
