# Image of backend/: the Django API served by gunicorn, static files included (WhiteNoise).
# Built from the root of the repo (compose.yaml, or podman build -f backend/Containerfile .).
# No migration at start: the deployment applies them before the switch; locally, compose.yaml
# runs them with the development server.
# uv only, never pip; a non-root user ([HARDENED-CONTAINERS]).
FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never PYTHONUNBUFFERED=1
WORKDIR /srv/backend
COPY backend/pyproject.toml backend/uv.lock backend/.python-version ./
RUN uv sync --locked --no-dev --no-install-project
COPY backend/ ./
# collectstatic reads no secret: a build-time key is enough, it serves nothing else.
RUN uv sync --locked --no-dev \
    && DJANGO_SECRET_KEY=image-build .venv/bin/python manage.py collectstatic --no-input \
    && useradd --system --create-home app && chown -R app /srv
# The image's environment first in PATH: `python` and `gunicorn` without going through uv, which
# would want to write its cache into a read-only file system.
ENV PATH="/srv/backend/.venv/bin:$PATH"
USER app
EXPOSE 8000
CMD ["gunicorn", "config.wsgi", "--bind", "0.0.0.0:8000", "--workers", "3", "--access-logfile", "-"]
