FROM quantconnect/lean:latest
# NOTE: stays on root because the official LEAN image puts `dotnet` under
# /root/.dotnet (not reachable by a non-root user). Least-privilege would
# require patching the base image itself; see SECURITY.md threat model.
USER root

COPY buy_and_hold.py /module/buy_and_hold.py
COPY download_samsung_data.py /module/download_samsung_data.py
COPY config.json /module/config.json
COPY entrypoint.sh /module/entrypoint.sh

RUN chmod +x /module/entrypoint.sh && mkdir -p /results

ENTRYPOINT ["/module/entrypoint.sh"]
