# Build from an operator-reviewed Hermes image that already contains its Python
# runtime and Node.js 24 or newer. EnvarLive gets a separate Python environment.
ARG HERMES_BASE_IMAGE
FROM $HERMES_BASE_IMAGE

ARG ENVARLIVE_VERSION
COPY dist/envarlive-$ENVARLIVE_VERSION-py3-none-any.whl /tmp/

RUN test -x /opt/hermes/.venv/bin/python \
    && node -e "const major=Number(process.versions.node.split('.')[0]); if(major<24) process.exit(1); require('node:sqlite').DatabaseSync" \
    && uv venv --python /usr/bin/python3 /opt/envarlive \
    && uv pip install --python /opt/envarlive/bin/python /tmp/envarlive-$ENVARLIVE_VERSION-py3-none-any.whl \
    && rm /tmp/envarlive-$ENVARLIVE_VERSION-py3-none-any.whl \
    && (getent passwd 10001 >/dev/null || useradd --uid 10001 --create-home \
         --home-dir /var/lib/envarlive --shell /usr/sbin/nologin envarlive) \
    && mkdir -p /var/lib/envarlive \
    && chown 10001:10001 /var/lib/envarlive

COPY deploy/docker-hermes/serve_stdin.py /opt/envarlive/bin/serve-stdin.py

ENV PATH=/opt/envarlive/bin:$PATH
USER 10001
WORKDIR /var/lib/envarlive
ENTRYPOINT ["/opt/envarlive/bin/envarlive"]
