FROM python:3.12-slim

WORKDIR /app
COPY . .

# Everything installed here is pinned: the extension's own dependencies come
# from [project].dependencies in pyproject.toml (all `==`), and so does the
# server. A package drop refuses a build on anything else.
RUN pip install --no-cache-dir . "uvicorn[standard]==0.54.0"

# The extension runs as an unprivileged user; it needs to read /app, never
# write to it.
RUN useradd --system --create-home --uid 10001 extension
USER extension

# A package drop builds this image with EXTENSION_VERSION set to the package's
# own [project].version, so Core's Deployments view shows the version you
# released. A plain local build keeps "dev".
ARG EXTENSION_VERSION=dev
ENV SUGARAI_EXTENSION_VERSION=$EXTENSION_VERSION

EXPOSE 8080
CMD ["uvicorn", "{module}.app:app.asgi", "--host", "0.0.0.0", "--port", "8080"]
