FROM python:3.14-slim

ENV PYTHONUNBUFFERED=1
WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential libpq-dev \
    && rm -rf /var/lib/apt/lists/*

COPY backend/requirements.txt .
{% if monorepo_contexts %}# --local-framework: the checkout's packages, copied in from additional_contexts
# (see docker-compose.yml). requirements.txt installs them editable from here.
{% for pkg in monorepo_contexts %}COPY --from={{ pkg.context_name }} . {{ pkg.container_path }}
{% endfor %}{% endif %}RUN pip install --no-cache-dir -r requirements.txt

# Root context: backend/ (the Django tree) plus apps/*/backend/ (app
# packages Django imports) - not react_frontend/ or apps/*/react_frontend/,
# but those are harmless to have in the image (docker-compose.yml's build
# context is the whole project root; see its comment).
COPY . /app

# Runs as a real unprivileged user rather than root - nothing here needs
# elevated privileges once dependencies are installed.
RUN useradd --create-home --uid 1000 appuser && chown -R appuser:appuser /app
USER appuser

CMD ["graphcore", "run"]
