FROM ghcr.io/astral-sh/uv:python3.12-slim-bookworm

WORKDIR /app

# The uv base image bundles uv, so no `pip install uv` needed. Copy the
# manifest + lockfile first as their own layer so editing source files
# doesn't bust the dep cache. ``uv.lock*`` is a glob so the file is
# optional (legacy projects without a lockfile still build); ``--frozen``
# refuses to mutate the lock at build time — if pyproject.toml drifts
# from uv.lock, the build fails loudly instead of silently floating
# versions, which is the whole #158 fix.
COPY pyproject.toml uv.lock* ./
RUN uv pip install --system --no-cache --frozen .

COPY . .

ENV PORT=8000
EXPOSE 8000

# Kernel runtime — parbaked finds your routes/ files and wires the
# auth/admin/health routers itself. No main.py needed.
CMD ["uvicorn", "parbaked.runtime:create_app", "--factory", "--host", "0.0.0.0", "--port", "8000"]
